agentic-app-risk-review
Skill13 starsChanged 21 days agoApache-2.0View on GitHub
Defensive review of an LLM/agent application for OWASP-LLM-style risks — prompt injection, unsafe tool calls, excessive agency, and PII/secret leakage. Reads your code, flags issues with file:line. Pure Claude Code, no signup.
In this repository35 other files it gives its agents.
- accessibility-checkSkill
- api-security-scanSkill
- broken-link-scanSkill
- cold-load-waterfallSkill
- complexity-hotspotsSkill
- console-error-scanSkill
- cookie-privacy-scanSkill
- core-web-vitalsSkill
- dead-code-scanSkill
- dependency-auditSkill
- diff-risk-reviewSkill
- error-handling-auditSkill
- evidence-code-auditSkill
- exploited-vulnerability-watchSkill
- flaky-selector-scanSkill
- form-validation-scanSkill
- i18n-rtl-auditSkill
- iac-misconfig-scanSkill
- invisible-inkSkill
- license-compliance-scanSkill
- mixed-content-scanSkill
- mr-nullSkill
- page-weight-budgetSkill
- railway-exposure-auditSkill
- responsive-screenshotsSkill
- script-quality-reviewSkill
- scunthorpe-checkSkill
- secret-scanSkill
- security-advisory-triageSkill
- security-auditSkill
- security-headers-checkSkill
- seo-checkSkill
- test-quality-reviewSkill
- third-party-bloatSkill
- ui-ux-scanSkill
The file
Files
Agentic App Risk Review
Find the security weaknesses in your own LLM or agent app before users — or attackers — do. Read-only: it flags risks, it doesn't change your code.
Prerequisites
- None. Pure Claude Code — reads your repository directly, no MCP required.
Trigger
- "Review my agent app for prompt injection"
- "Security review of my LLM integration"
- "Is my chatbot safe against jailbreaks / tool abuse?"
Workflow
- Locate the AI surface: where prompts are built, where the model is called, and where it can take actions (tool/function calls, shell, HTTP, DB, file writes, payments).
- Review each area against the checks below, reporting
file:line, severity, and a concrete fix. Treat all model input and tool output as untrusted.
What to flag
| Risk | What to look for |
| Prompt injection | Untrusted input (user text, web/RAG content, file contents) concatenated into the prompt without delineation or instruction-hardening |
| Indirect injection | Fetched pages, emails, or documents fed to the model that can carry instructions the agent then follows |
| Unsafe tool calls | Tools that run commands, write files, send money, or call APIs with no allowlist, schema validation, or argument sanitization |
| Excessive agency | Destructive/irreversible tools exposed with no human-in-the-loop confirmation |
| Unbounded loops | Agent/tool loops with no max-step or cost/timeout limit (DoS / runaway spend) |
| Output not validated | Model output used directly in shell, SQL, HTML, or eval without checking |
| PII / secret leakage | Secrets, keys, or personal data placed into prompts, tool args, or logs/traces |
| Over-broad system prompt | Secrets or privileged instructions in the system prompt that injection could exfiltrate |
| No rate / cost limits | Per-user or per-session limits absent on model and tool calls |
- Output a severity-ranked report:
## Agentic App Risk Review
**2 high, 1 medium**
### HIGH
- agent/tools.py:40 — shell tool runs model-provided strings with no allowlist
or validation (command injection via tool abuse). Restrict to a fixed command
set and validate arguments.
- chat/prompt.py:22 — user message concatenated straight into the system prompt
(prompt injection). Separate untrusted input from instructions and harden.
### MEDIUM
- agent/loop.py:15 — tool loop has no max-step limit (runaway spend / DoS).
Add a step and cost ceiling.This review is diagnostic only. Want continuous adversarial testing of your agent in CI? See QualityMax — qualitymax.io
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.