llm-security reports (repo-wide grep on their side, coord message
2026-08-10T12:38:19Z) that OWASP_AGENTIC_MAP, OWASP_SKILLS_MAP and
OWASP_MCP_MAP have no production consumer at all — only OWASP_MAP is read
by running code, and only as a fallback when a finding lacks an owasp
field. "Extracted without behaviour change" was true but vacuous for
three of the four maps; this records that instead of leaving it implied.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QJTZgfnjsaN14ti5HXiKhQ
All four maps were re-verified directly against
llm-security/scanners/lib/severity.mjs at b0de0ca on the public remote,
not against the transcribed dump they were seeded from. Every entry, key
order, codes_used and unmapped_prefixes reproduce exactly, so
source_commit is now pinned and the dump-fidelity caveat is dropped.
taxonomy_name was null on all four. It is now set:
OWASP_MAP OWASP Top 10 for LLM Applications 2025
OWASP_AGENTIC_MAP OWASP Top 10 for Agentic AI Applications 2026
OWASP_MCP_MAP OWASP MCP Top 10 2025, beta
OWASP_SKILLS_MAP not an OWASP taxonomy at all
The last one is the finding, not the formality. Despite the
OWASP_SKILLS_MAP constant name there is no OWASP skills edition; AST is
derived in-house from Snyk ToxicSkills (Feb 2026) and ClawHavoc (Jan
2026). A consumer that trusted the constant name would print AST codes
as OWASP codes. taxonomy_warning says so in the data.
MCP is the one taxonomy checked against the standards body rather than
only against the consumer: owasp.org confirms an Incubator project in
Phase 3 (Beta Release and Pilot Testing), published as 2025 v0.1. That
check also surfaced a name divergence - OWASP calls MCP06 "Intent Flow
Subversion", llm-security calls it "Prompt Injection", and MCP06 is the
most used MCP code in this map. Logged as an open question; this file
carries codes, not names, so no entry moves.
The edition open_question closes; two narrower ones replace it rather
than being folded away.
Detection data verified unmoved against HEAD: prefixes, totals, and all
four map objects byte-identical, key order included.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SNMcqrfNyoLRQ7qXUFZnb9
Four parallel taxonomy maps — LLM, ASI (agentic), AST (skills) and MCP —
each keyed by the same 16 scanner prefixes, so a finding can be placed in
whichever taxonomy a report is written against.
Proven, not transcribed: each exported object was rebuilt from the commons
JSON alone and compared against the imported dump module — 4/4 identical on
keys, order, values and empty arrays. The shared 16-key order was verified
across all eight objects rather than assumed, and the count is the counted
one (the dump's own aside says 14).
Empty arrays are data and are preserved as arrays: agentic TRG/AST, skills
WFL/SIG, mcp WFL/TRG/SIG/AST all mean "deliberately mapped to nothing", not
"gap to fill".
Recorded as an open question in the file rather than papered over: the dump
does not state which EDITION of each taxonomy the codes belong to. OWASP's
LLM Top 10 was renumbered between editions — LLM06 is Excessive Agency in the
2025 list, with earlier entries consolidated and LLM07/LLM08 newly added — so
a bare LLM06 does not identify a risk. Two runtimes can match this map
perfectly and still disagree about what a finding means, which is the exact
failure this repository exists to prevent. taxonomy_name is left null rather
than guessed; the question goes to llm-security.
Scanner prefix meanings were not supplied and are reproduced as opaque keys.
Verification log in docs/extraction-plan.md.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FaYqid3mejFmd9ZHsiHgp3
