secure-agent-playbook

Third-Party Notices

This project incorporates or references material from the following third-party sources.

Arcanum Prompt Injection Taxonomy

• Source: Arcanum-Sec/arc_pi_taxonomy
• Author: Jason Haddix, Arcanum Information Security
• License: CC BY 4.0
• Used in: plugins/ai-security-skills/plays/prompt-injection-testing.md, plugins/ai-security-skills/skills/prompt-injection-test/SKILL.md
• Usage: Attack intent, technique, and evasion classifications for prompt injection testing

OWASP Agent Skills Project (ASVS 5.0 Data)

• Source: eoftedal/owasp-agent-skills-project
• Author: Erlend Oftedal and contributors
• License: CC BY-SA 4.0 (OWASP ASVS)
• Used in: plugins/code-security-skills/data/asvs/ (80 section files V1.1 through V17.3)
• Usage: ASVS 5.0 verification requirements with YAML frontmatter for context-aware lookups

OpenCRE (Open Common Requirements Enumeration)

• Source: opencre.org
• License: Apache 2.0
• Used in: data/opencre/, cross-standard references in all findings
• Usage: CRE ID mappings for cross-standard traceability (CWE, ASVS, WSTG, NIST 800-53)

OWASP Standards

The following OWASP standards are referenced throughout this project:

Standard	License	Usage
OWASP Top 10 (2021)	CC BY-SA 4.0	Risk classification in all plays
OWASP API Security Top 10 (2023)	CC BY-SA 4.0	API security review play
OWASP Top 10 for LLM Applications	CC BY-SA 4.0	LLM risk assessment play
OWASP Top 10 for Agentic Applications (2026)	CC BY-SA 4.0	Agentic AI risk assessment play
OWASP ASVS	CC BY-SA 4.0	Verification-level mapping
OWASP WSTG	CC BY-SA 4.0	Testing methodology references
OWASP MASVS v2.1.0	CC BY-SA 4.0	Mobile control files in plugins/code-security-skills/data/masvs/ (mobile code review)
OWASP MASTG	CC BY-SA 4.0	Per-test recipes in plugins/code-security-skills/data/mastg/ (mobile code review)
OWASP AISVS	CC BY-SA 4.0	AI security verification play; section files in data/aisvs/
OWASP FIASSE v1.0.4	CC BY-SA 4.0	Code attribute and securable principle references (see also plugins/code-security-skills/data/fiasse/)

SecCodePrompts

• Source: theJonMccoy/SecCodePrompts
• Author: Jon McCoy and contributors
• License: MIT
• Used in: plugins/code-security-skills/data/secure-code-prompts/ (Terraform, Kubernetes, CloudFormation, API design prompts)
• Usage: Infrastructure-as-code security review checklists adapted with YAML frontmatter and OWASP standard mappings

CWE (Common Weakness Enumeration)

• Source: cwe.mitre.org
• Author: MITRE Corporation
• License: CWE Terms of Use
• Usage: Weakness classification in findings

This site is open source. Improve this page.