Add AVE (Agentic Vulnerability Enumeration) - #38
Open
chaksaray wants to merge 1 commit into
Open
Conversation
…Firewalls Open standard for behavioral vulnerability classification in agentic AI components, same category and subcategory as the existing OWASP LLM Top 10 entry (Security Guardrails & Firewalls / Prompt & Runtime Guardrails), a classification framework rather than a runtime tool. Checked for precedent first: no existing or previously-proposed entry for AVE or a similar classification standard anywhere in landscape.yml or in the repo's open/closed issues and PRs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds AVE to Security Guardrails & Firewalls, subcategory Prompt & Runtime Guardrails, directly after the existing OWASP LLM Top 10 entry -- same category and subcategory, a classification framework rather than a runtime tool, matching that entry's precedent.
What
AVE (Agentic Vulnerability Enumeration) is an open standard assigning stable identifiers to behavioral vulnerability classes in agentic AI components (MCP servers, agent skills, LLM plugins), scored with OWASP's AIVSS framework. It crosswalks into OWASP's MCP Top 10 and MITRE ATLAS. github.com/aveproject/ave, Apache 2.0.
Precedent check
Before drafting, checked all open/closed issues and PRs in this repo for a stated landscape-entry contribution process and for any prior proposal, addition, or rejection of a similar classification standard/taxonomy. Found none -- no existing AVE entry, no prior competing proposal. Followed the pattern from #25/#27 (goose) and #29/#30 (agentgateway, AGENTS.md) instead: cite real metadata, verify URLs directly, note the placement reasoning.
Validation
landscape/landscape.ymlparses as valid YAML.docs/data-schemas.md: requiredname,homepage_url(https, verified 200),description(no marketing superlatives),project: external(matches OWASP LLM Top 10 and other non-member standards in this file); optionalrepo_urlincluded and verified (200).homepage_urlandrepo_urlboth checked directly, not assumed.AI assistance note: AI assistance was used to draft this contribution. I reviewed the final text against the repository schema, the live landscape.yml content, and the contribution guidelines before submitting.