[FEATURE]: Add LLM security agent based on OWASP LLM Top 10

[Nislive]

Feature hasn't been suggested before.

• I have verified this feature hasn't been suggested before.

Category

Security Agent

Description

Summary

Add a new security agent that tests chatbots and LLM-based
applications for common vulnerabilities, built around the
OWASP LLM Top 10 framework.

Motivation

LLM-based applications are increasingly common but lack
dedicated security testing tools within this project. An
agent that systematically checks against OWASP LLM Top 10
risks (prompt injection, insecure output handling, training
data poisoning, etc.) would fill this gap.

Proposed solution

• New agent module dedicated to LLM security testing
• SKILL.md file defining the testing methodology
• Step-by-step execution following OWASP LLM Top 10 categories
• Ability to target chatbots and LLM endpoints

Verification

Tested locally against a Llama 3.1 8B model. The agent
successfully loaded the SKILL.md, executed security tests
step-by-step, and identified vulnerabilities.

Related PR

Implementation ready in #33

[vgudur-dev]

This is a great initiative — a dedicated OWASP LLM Top 10 security agent fills a real gap in automated testing.

One coverage area worth adding to the SKILL.md: OWASP ASI06 (Memory Poisoning) from the Agentic AI Top 10, which is distinct from the standard LLM Top 10 but increasingly relevant as agents gain persistent memory. The attack vector is the write path to memory stores (vector DBs, markdown files, SQLite), not just the input layer.

For the benchmark/verification step, AgentThreatBench provides 847 labeled attack scenarios across 6 categories (indirect injection, memory poisoning, tool hijacking, goal hijacking, context manipulation, exfiltration) — useful for validating that the security agent catches the full OWASP Agentic Top 10 surface.

The OWASP Agent Memory Guard project also has reference test fixtures that could be integrated into the SKILL.md test methodology.

Mapping suggestion for the SKILL.md:

OWASP Category	Test Type	Coverage
LLM01: Prompt Injection	Direct + indirect	Input layer
LLM02: Insecure Output Handling	Output parsing	Response layer
ASI06: Memory Poisoning	Write-path validation	Persistence layer
ASI09: Prompt Leakage	System prompt extraction	Context layer

[Nislive]

Thanks, this is really helpful feedback. The ASI06 angle especially got me thinking that agent security could be a good follow-up scope. Appreciate you laying it out in this much detail.