OverviewHistoryStatsSecurity
npx skills add ...
Documentation
SKILL.md
npx skills add semgrep/skills --skill llm-security
Security guidelines for LLM applications based on OWASP Top 10 for LLM 2025. Use when building LLM apps, reviewing AI security, implementing RAG systems, or asking about LLM vulnerabilities like 'prompt injection' or 'check LLM security'. IMPORTANT: Always consult this skill when building chatbots, AI agents, RAG pipelines, tool-using LLMs, agentic systems, or any application that calls an LLM API (OpenAI, Anthropic, Gemini, etc.) — even if the user doesn't explicitly mention security. Also use when users import 'openai', 'anthropic', 'langchain', 'llamaindex', or similar LLM libraries.
npx skills add semgrep/skills --skill llm-security
Security rules for building secure LLM applications, based on the OWASP Top 10 for LLM Applications 2025.
Proactive mode — When building or reviewing LLM applications, automatically check for relevant security risks based on the application pattern. You don't need to wait for the user to ask about LLM security.
Reactive mode — When the user asks about LLM security, use the mapping below to find relevant rule files with detailed vulnerable/secure code examples.
rules/ for code examplesUse this to quickly identify which rules matter most for the user's task:
| Building... | Priority Rules |
|---|---|
| Chatbot / conversational AI | Prompt Injection (LLM01), System Prompt Leakage (LLM07), Output Handling (LLM05), Unbounded Consumption (LLM10) |
| RAG system | Vector/Embedding Weaknesses (LLM08), Prompt Injection (LLM01), Sensitive Disclosure (LLM02), Misinformation (LLM09) |
| AI agent with tools | Excessive Agency (LLM06), Prompt Injection (LLM01), Output Handling (LLM05), Sensitive Disclosure (LLM02) |
| Fine-tuning / training | Data Poisoning (LLM04), Supply Chain (LLM03), Sensitive Disclosure (LLM02) |
| LLM-powered API | Unbounded Consumption (LLM10), Prompt Injection (LLM01), Output Handling (LLM05), Sensitive Disclosure (LLM02) |
| Content generation | Misinformation (LLM09), Output Handling (LLM05), Prompt Injection (LLM01) |
rules/prompt-injection.md) - Prevent direct and indirect prompt manipulationrules/sensitive-disclosure.md) - Protect PII, credentials, and proprietary datarules/supply-chain.md) - Secure model sources, training data, and dependenciesrules/data-poisoning.md) - Prevent training data manipulation and backdoorsrules/output-handling.md) - Sanitize LLM outputs before downstream userules/excessive-agency.md) - Limit LLM permissions, functionality, and autonomyrules/system-prompt-leakage.md) - Protect system prompts from disclosurerules/vector-embedding.md) - Secure RAG systems and embeddingsrules/misinformation.md) - Mitigate hallucinations and false outputsrules/unbounded-consumption.md) - Prevent DoS, cost attacks, and model theftSee rules/_sections.md for the full index with OWASP/MITRE references.
| Vulnerability | Key Prevention |
|---|---|
| Prompt Injection | Input validation, output filtering, privilege separation |
| Sensitive Disclosure | Data sanitization, access controls, encryption |
| Supply Chain | Verify models, SBOM, trusted sources only |
| Data Poisoning | Data validation, anomaly detection, sandboxing |
| Output Handling | Treat LLM as untrusted, encode outputs, parameterize queries |
| Excessive Agency | Least privilege, human-in-the-loop, minimize extensions |
| System Prompt Leakage | No secrets in prompts, external guardrails |
| Vector/Embedding | Access controls, data validation, monitoring |
| Misinformation | RAG, fine-tuning, human oversight, cross-verification |
| Unbounded Consumption | Rate limiting, input validation, resource monitoring |