OWASP ASI Risk Classifier
Tags AI agent security findings with standard OWASP agentic risk categories (ASI01–ASI10)
- Repository
- Tencent/AI-Infra-Guard
- Stars
- 7,320
- Licence
- Apache-2.0
- Files
- 1 file
What it does
This skill gives an AI agent a reference card for the OWASP Top 10 for Agentic Applications 2026, a standard list of security risk types for AI agents such as goal hijacking, tool misuse, supply chain attacks and rogue agents. When you have security findings, the agent uses the included mapping tables to label each one with the matching risk ID and a severity level with suggested remediation timelines. It does not scan anything itself; it only organizes findings that come from elsewhere.
Great for
- Security engineers who need to label AI agent vulnerability findings with a standard taxonomy
- Teams writing audit reports that must reference OWASP agentic risk IDs
- Developers triaging findings from an agent security scanner and wanting consistent severity labels
Skip it if
- Anyone expecting it to find vulnerabilities by itself: it contains no scanning logic, only classification tables, so it cannot inspect a codebase or agent on its own
- Non-security uses: the content is specific to security risk classification and offers little for general agent tasks
- Relying on its severity timelines as policy without review: they are suggestions built into the file, not an official OWASP standard for your organization
Try asking
- “Map these three findings from my scan to OWASP ASI categories and severity levels: exposed API key in logs, system prompt leaked to users, and a shell command built from unvalidated input”
- “Which ASI risk does package poisoning in an agent's dependencies fall under?”
- “Classify this report's findings by ASI category and produce a table with suggested remediation windows”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 1 original files, the Apache-2.0 licence and an attribution note.
owasp-asi.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip owasp-asi.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip owasp-asi.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Paste the raw finding descriptions along with the evidence so the agent can match them to the right ASI row rather than guessing from a short title.
- Treat the severity table as a starting point and adjust it to your organization's own risk policy.
- Pair it with a detection tool that actually produces findings; this skill is most useful as the labelling step after scanning.
What's inside
- SKILL.md
Redistributed unmodified from Tencent/AI-Infra-Guard under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.