open/llm-security-commons
1
0
Fork 0
Code Issues Releases 1 Activity

feat(mapping): name each taxonomy, close the edition question

Browse source 
All four maps were re-verified directly against
llm-security/scanners/lib/severity.mjs at b0de0ca on the public remote,
not against the transcribed dump they were seeded from. Every entry, key
order, codes_used and unmapped_prefixes reproduce exactly, so
source_commit is now pinned and the dump-fidelity caveat is dropped.

taxonomy_name was null on all four. It is now set:

  OWASP_MAP         OWASP Top 10 for LLM Applications 2025
  OWASP_AGENTIC_MAP OWASP Top 10 for Agentic AI Applications 2026
  OWASP_MCP_MAP     OWASP MCP Top 10 2025, beta
  OWASP_SKILLS_MAP  not an OWASP taxonomy at all

The last one is the finding, not the formality. Despite the
OWASP_SKILLS_MAP constant name there is no OWASP skills edition; AST is
derived in-house from Snyk ToxicSkills (Feb 2026) and ClawHavoc (Jan
2026). A consumer that trusted the constant name would print AST codes
as OWASP codes. taxonomy_warning says so in the data.

MCP is the one taxonomy checked against the standards body rather than
only against the consumer: owasp.org confirms an Incubator project in
Phase 3 (Beta Release and Pilot Testing), published as 2025 v0.1. That
check also surfaced a name divergence - OWASP calls MCP06 "Intent Flow
Subversion", llm-security calls it "Prompt Injection", and MCP06 is the
most used MCP code in this map. Logged as an open question; this file
carries codes, not names, so no entry moves.

The edition open_question closes; two narrower ones replace it rather
than being folded away.

Detection data verified unmoved against HEAD: prefixes, totals, and all
four map objects byte-identical, key order included.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SNMcqrfNyoLRQ7qXUFZnb9
This commit is contained in:
Kjell Tore Guttormsen 2026-08-09 22:33:50 +02:00
commit 95dea9ba90
1 changed files with 41 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

54
mapping/owasp-map.json
View file

@ -1,8 +1,8 @@
{ {
"version": "0.1.0", "version": "0.2.0",
"id": "owasp-map", "id": "owasp-map",
"description": "Finding-id prefix to OWASP taxonomy codes, in four parallel maps. Every map is keyed by the same 16 scanner prefixes, so a finding carrying a prefix can be placed in whichever taxonomy a report is written against. An empty array means the seed implementation deliberately maps that prefix to nothing in that taxonomy - it is data, not a gap to fill.", "description": "Finding-id prefix to OWASP taxonomy codes, in four parallel maps. Every map is keyed by the same 16 scanner prefixes, so a finding carrying a prefix can be placed in whichever taxonomy a report is written against. An empty array means the seed implementation deliberately maps that prefix to nothing in that taxonomy - it is data, not a gap to fill.",
"$comment": "Extracted without behaviour change from llm-security/scanners/lib/severity.mjs (OWASP_MAP, OWASP_AGENTIC_MAP, OWASP_SKILLS_MAP, OWASP_MCP_MAP), delivered as operator dump 2/2 through the local coord mailbox on 2026-08-09. The dump states that a fallback map inside one of llm-security's own agent definitions covers only part of the prefix set; that is known drift in the consumer and is explicitly NOT inherited here. The maps below are the complete 16-prefix set from severity.mjs.", "$comment": "Extracted without behaviour change from llm-security/scanners/lib/severity.mjs (OWASP_MAP, OWASP_AGENTIC_MAP, OWASP_SKILLS_MAP, OWASP_MCP_MAP). Seeded 2026-08-09 from an operator dump; re-verified the same day directly against the module file at commit b0de0ca on the public remote, which is why source_commit is now pinned and the dump-fidelity caveat is gone. The dump states that a fallback map inside one of llm-security's own agent definitions covers only part of the prefix set; that is known drift in the consumer and is explicitly NOT inherited here. The maps below are the complete 16-prefix set from severity.mjs.",
"provenance": { "provenance": {
"source_repo": "llm-security", "source_repo": "llm-security",
"source_files": [ "source_files": [
@ -14,13 +14,13 @@
"OWASP_SKILLS_MAP", "OWASP_SKILLS_MAP",
"OWASP_MCP_MAP" "OWASP_MCP_MAP"
], ],
"source_delivery": "operator dump 2/2, coord message from llm-security, 2026-08-09", "source_delivery": "operator dump 2/2, coord message from llm-security, 2026-08-09; superseded by a direct read of the module at the pinned commit below",
"source_commit": "unknown - not supplied with the dump", "source_commit": "b0de0ca6d86ce697f39669d177c2c2654c280128",
"verified": "differentially, against the dump", "source_remote": "ssh://git@git.fromaitochitta.com/open/llm-security.git",
"verified": "differentially, against the module file at b0de0ca - all four maps, key order, codes_used and unmapped_prefixes reproduced mechanically and compared, 2026-08-09",
"evidence_limits": [ "evidence_limits": [
"The dump is a transcription of the source module, not the module file itself. The checks recorded for this file prove that this JSON agrees with the DUMP; dump-to-module fidelity is llm-security's assertion, not a result reproduced here.",
"What each scanner prefix MEANS was not supplied. The prefixes are reproduced as opaque keys; no expansion of UNI, ENT, PRM and the rest is invented here.", "What each scanner prefix MEANS was not supplied. The prefixes are reproduced as opaque keys; no expansion of UNI, ENT, PRM and the rest is invented here.",
"Which EDITION of each taxonomy these codes belong to was not supplied. See open_questions - this is the one thing in this file a consumer can get wrong while matching it exactly." "The taxonomy_name strings are the identity of an external standard, not data read out of severity.mjs - the module names no edition anywhere. They were supplied by llm-security and, for the LLM/agentic/skills maps, cross-read against that repo's knowledge/ documents; only the MCP edition and status were additionally confirmed against the OWASP project page. A consumer that disagrees about which edition a code belongs to should raise it here rather than renumber locally."
] ]
}, },
"prefixes": { "prefixes": {
@ -50,15 +50,32 @@
"id": "taxonomy-edition-unstated", "id": "taxonomy-edition-unstated",
"question": "Which edition of each OWASP taxonomy do these codes refer to?", "question": "Which edition of each OWASP taxonomy do these codes refer to?",
"why_it_matters": "OWASP's Top 10 for LLM Applications was renumbered between editions: in the 2025 edition LLM06 is Excessive Agency, and entries present in the earlier list were consolidated into other numbers, with System Prompt Leakage and Vector and Embedding Weaknesses added as LLM07 and LLM08. A bare code such as LLM06 therefore does not identify a risk on its own. Two runtimes can reproduce this map perfectly and still publish reports that disagree about what a finding means, which is precisely the failure this repository exists to prevent.", "why_it_matters": "OWASP's Top 10 for LLM Applications was renumbered between editions: in the 2025 edition LLM06 is Excessive Agency, and entries present in the earlier list were consolidated into other numbers, with System Prompt Leakage and Vector and Embedding Weaknesses added as LLM07 and LLM08. A bare code such as LLM06 therefore does not identify a risk on its own. Two runtimes can reproduce this map perfectly and still publish reports that disagree about what a finding means, which is precisely the failure this repository exists to prevent.",
"status": "open - reported to llm-security, to be decided where the maps are maintained", "status": "closed 2026-08-09 - answered by llm-security in the coord mailbox and written into taxonomy_name on each of the four maps below",
"resolution_shape": "An edition or version string per taxonomy, recorded alongside code_prefix. Deliberately left null rather than guessed." "resolution": "Three of the four are OWASP editions and are named as such. The fourth, OWASP_SKILLS_MAP, is not an OWASP taxonomy at all despite the constant name - see the skills entry. The edition question is therefore answered, but two narrower ones took its place and are recorded as open_questions below rather than folded away."
},
{
"id": "mcp-codes-may-move",
"question": "Are the MCP codes stable enough to treat as a contract?",
"why_it_matters": "The OWASP MCP Top 10 is an Incubator project in Phase 3 (Beta Release and Pilot Testing), published as 2025 v0.1, with continuous improvement scheduled from October 2026. Category numbering can still shift. A consumer that pins a report format to MCP01-MCP10 is pinning to a moving target, and the mapping in this file will need a version bump when it moves.",
"status": "open - accepted risk, no action available here",
"resolution_shape": "Re-read the OWASP project page when the beta closes and bump this file if numbering changed."
},
{
"id": "mcp06-name-divergence",
"question": "What is MCP06 called?",
"why_it_matters": "OWASP names MCP06:2025 'Intent Flow Subversion'. llm-security's knowledge/mcp-threat-patterns.md:7 calls it 'Prompt Injection'. MCP06 is the most heavily used MCP code in this map (six prefixes), so the two runtimes could agree perfectly on the code and still print different risk names in a report. The same divergence exists in shorter form on MCP02 ('Privilege Escalation via Scope Creep' vs 'Privilege Escalation') and MCP10 ('Context Injection & Over-Sharing' vs 'Context Over-Sharing'), where the shortened names are at least recognisably the same risk.",
"status": "open - reported here, to be fixed in llm-security's knowledge document",
"resolution_shape": "This file carries codes, not names, so nothing here changes. Fixed by llm-security aligning its reference document, or by this file growing a code-to-name table if consumers need one."
} }
], ],
"taxonomies": { "taxonomies": {
"llm": { "llm": {
"source_export": "OWASP_MAP", "source_export": "OWASP_MAP",
"code_prefix": "LLM", "code_prefix": "LLM",
"taxonomy_name": null, "taxonomy_name": "OWASP Top 10 for LLM Applications 2025",
"taxonomy_owner": "OWASP GenAI Security Project",
"taxonomy_status": "published",
"taxonomy_name_evidence": "Stated by llm-security 2026-08-09; the title line of that repo's knowledge/owasp-llm-top10.md at b0de0ca reads 'OWASP Top 10 for LLM Applications (2025)' and its LLM06 entry is Excessive Agency, which is the 2025 numbering.",
"codes_used": [ "codes_used": [
"LLM01", "LLM01",
"LLM02", "LLM02",
@ -130,7 +147,10 @@
"agentic": { "agentic": {
"source_export": "OWASP_AGENTIC_MAP", "source_export": "OWASP_AGENTIC_MAP",
"code_prefix": "ASI", "code_prefix": "ASI",
"taxonomy_name": null, "taxonomy_name": "OWASP Top 10 for Agentic AI Applications 2026",
"taxonomy_owner": "OWASP GenAI Security Project",
"taxonomy_status": "published",
"taxonomy_name_evidence": "Stated by llm-security 2026-08-09 as the ASI list from the December 2025 release; the title line of that repo's knowledge/owasp-agentic-top10.md at b0de0ca reads 'OWASP Top 10 for Agentic AI Applications (2026)' and names the prefix ASI (Agentic Security Issue).",
"codes_used": [ "codes_used": [
"ASI01", "ASI01",
"ASI02", "ASI02",
@ -203,7 +223,11 @@
"skills": { "skills": {
"source_export": "OWASP_SKILLS_MAP", "source_export": "OWASP_SKILLS_MAP",
"code_prefix": "AST", "code_prefix": "AST",
"taxonomy_name": null, "taxonomy_name": "llm-security AST (AI Skills Threat) - repo-owned, unversioned",
"taxonomy_owner": "llm-security",
"taxonomy_status": "not an OWASP taxonomy",
"taxonomy_name_evidence": "Stated by llm-security 2026-08-09: no OWASP edition exists, AST is not an OWASP product despite the OWASP_SKILLS_MAP constant name, and the constant name is a known misnomer they own. Confirmed by reading knowledge/owasp-skills-top10.md at b0de0ca, whose title is 'AI Skills Top 10 (AST)' and whose source line reads 'Derived from Snyk ToxicSkills research (Feb 2026), ClawHavoc campaign (Jan 2026), skill-scanner-agent threat model, and cross-mapped to OWASP LLM Top 10 and Agentic Top 10.' The cross-mapping is to OWASP; the taxonomy is not.",
"taxonomy_warning": "Do not present AST codes as OWASP codes in a report, and do not infer an OWASP edition for them. The source_export name is the only thing here that says OWASP, and it is wrong.",
"codes_used": [ "codes_used": [
"AST01", "AST01",
"AST02", "AST02",
@ -273,7 +297,11 @@
"mcp": { "mcp": {
"source_export": "OWASP_MCP_MAP", "source_export": "OWASP_MCP_MAP",
"code_prefix": "MCP", "code_prefix": "MCP",
"taxonomy_name": null, "taxonomy_name": "OWASP MCP Top 10 2025",
"taxonomy_owner": "OWASP",
"taxonomy_status": "beta - Incubator project, Phase 3 (Beta Release and Pilot Testing), published as 2025 v0.1",
"taxonomy_name_evidence": "Stated by llm-security 2026-08-09 as 'OWASP MCP Top 10 2025' with codes written MCP01:2025 through MCP10:2025, together with the caveat that the project is officially OWASP but still in beta so the codes can move. Both the edition label and the Phase 3 beta status were independently confirmed against https://owasp.org/www-project-mcp-top-10/ on 2026-08-09 - this is the only taxonomy in this file checked against the standards body rather than only against the consumer.",
"taxonomy_warning": "Codes are provisional. See open_questions mcp-codes-may-move and mcp06-name-divergence.",
"codes_used": [ "codes_used": [
"MCP01", "MCP01",
"MCP02", "MCP02",