llm-security

作成者： semgrep

OWASP Top 10 for LLM 2025に基づくLLMアプリケーションのセキュリティガイドライン。LLMアプリの構築時、AIセキュリティのレビュー時、RAGシステムの実装時などに使用します。

npx skills add https://github.com/semgrep/skills --skill llm-security
ZIPダウンロードGitHub
231

LLM Security Guidelines (OWASP Top 10 for LLM 2025)

Security rules for building secure LLM applications, based on the OWASP Top 10 for LLM Applications 2025.

How to Use This Skill

Proactive mode — When building or reviewing LLM applications, automatically check for relevant security risks based on the application pattern. You don't need to wait for the user to ask about LLM security.

Reactive mode — When the user asks about LLM security, use the mapping below to find relevant rule files with detailed vulnerable/secure code examples.

Workflow

  1. Identify what the user is building (see "What Are You Building?" below)
  2. Check the priority rules for that pattern
  3. Read the specific rule files from rules/ for code examples
  4. Apply the secure patterns or flag vulnerable ones

What Are You Building?

Use this to quickly identify which rules matter most for the user's task:

Building...Priority Rules
Chatbot / conversational AIPrompt Injection (LLM01), System Prompt Leakage (LLM07), Output Handling (LLM05), Unbounded Consumption (LLM10)
RAG systemVector/Embedding Weaknesses (LLM08), Prompt Injection (LLM01), Sensitive Disclosure (LLM02), Misinformation (LLM09)
AI agent with toolsExcessive Agency (LLM06), Prompt Injection (LLM01), Output Handling (LLM05), Sensitive Disclosure (LLM02)
Fine-tuning / trainingData Poisoning (LLM04), Supply Chain (LLM03), Sensitive Disclosure (LLM02)
LLM-powered APIUnbounded Consumption (LLM10), Prompt Injection (LLM01), Output Handling (LLM05), Sensitive Disclosure (LLM02)
Content generationMisinformation (LLM09), Output Handling (LLM05), Prompt Injection (LLM01)

Categories

Critical Impact

  • LLM01: Prompt Injection (rules/prompt-injection.md) - Prevent direct and indirect prompt manipulation
  • LLM02: Sensitive Information Disclosure (rules/sensitive-disclosure.md) - Protect PII, credentials, and proprietary data
  • LLM03: Supply Chain (rules/supply-chain.md) - Secure model sources, training data, and dependencies
  • LLM04: Data and Model Poisoning (rules/data-poisoning.md) - Prevent training data manipulation and backdoors
  • LLM05: Improper Output Handling (rules/output-handling.md) - Sanitize LLM outputs before downstream use

High Impact

  • LLM06: Excessive Agency (rules/excessive-agency.md) - Limit LLM permissions, functionality, and autonomy
  • LLM07: System Prompt Leakage (rules/system-prompt-leakage.md) - Protect system prompts from disclosure
  • LLM08: Vector and Embedding Weaknesses (rules/vector-embedding.md) - Secure RAG systems and embeddings
  • LLM09: Misinformation (rules/misinformation.md) - Mitigate hallucinations and false outputs
  • LLM10: Unbounded Consumption (rules/unbounded-consumption.md) - Prevent DoS, cost attacks, and model theft

See rules/_sections.md for the full index with OWASP/MITRE references.

Quick Reference

VulnerabilityKey Prevention
Prompt InjectionInput validation, output filtering, privilege separation
Sensitive DisclosureData sanitization, access controls, encryption
Supply ChainVerify models, SBOM, trusted sources only
Data PoisoningData validation, anomaly detection, sandboxing
Output HandlingTreat LLM as untrusted, encode outputs, parameterize queries
Excessive AgencyLeast privilege, human-in-the-loop, minimize extensions
System Prompt LeakageNo secrets in prompts, external guardrails
Vector/EmbeddingAccess controls, data validation, monitoring
MisinformationRAG, fine-tuning, human oversight, cross-verification
Unbounded ConsumptionRate limiting, input validation, resource monitoring

Key Principles

  1. Never trust LLM output - Validate and sanitize all outputs before use
  2. Least privilege - Grant minimum necessary permissions to LLM systems
  3. Defense in depth - Layer multiple security controls
  4. Human oversight - Require approval for high-impact actions
  5. Monitor and log - Track all LLM interactions for anomaly detection

References

semgrepのその他のスキル

setup-semgrep-plugin
semgrep
Semgrepをインストールし、認証を行い、互換性を確認してSemgrepプラグインをセットアップします。
official
code-security
semgrep
セキュアなコードを記述するためのセキュリティガイドライン。コードの作成時、脆弱性のレビュー時、または「チェックして…」のようなセキュアなコーディング手法について質問する際に使用します。
official
semgrep
semgrep
Semgrep静的解析スキャンを実行し、カスタム検出ルールを作成します。Semgrepでコードをスキャンするよう求められた場合、セキュリティ脆弱性を発見する場合、カスタムYAMLを作成する場合などに使用します。
official