All four maps were re-verified directly against
llm-security/scanners/lib/severity.mjs at b0de0ca on the public remote,
not against the transcribed dump they were seeded from. Every entry, key
order, codes_used and unmapped_prefixes reproduce exactly, so
source_commit is now pinned and the dump-fidelity caveat is dropped.
taxonomy_name was null on all four. It is now set:
OWASP_MAP OWASP Top 10 for LLM Applications 2025
OWASP_AGENTIC_MAP OWASP Top 10 for Agentic AI Applications 2026
OWASP_MCP_MAP OWASP MCP Top 10 2025, beta
OWASP_SKILLS_MAP not an OWASP taxonomy at all
The last one is the finding, not the formality. Despite the
OWASP_SKILLS_MAP constant name there is no OWASP skills edition; AST is
derived in-house from Snyk ToxicSkills (Feb 2026) and ClawHavoc (Jan
2026). A consumer that trusted the constant name would print AST codes
as OWASP codes. taxonomy_warning says so in the data.
MCP is the one taxonomy checked against the standards body rather than
only against the consumer: owasp.org confirms an Incubator project in
Phase 3 (Beta Release and Pilot Testing), published as 2025 v0.1. That
check also surfaced a name divergence - OWASP calls MCP06 "Intent Flow
Subversion", llm-security calls it "Prompt Injection", and MCP06 is the
most used MCP code in this map. Logged as an open question; this file
carries codes, not names, so no entry moves.
The edition open_question closes; two narrower ones replace it rather
than being folded away.
Detection data verified unmoved against HEAD: prefixes, totals, and all
four map objects byte-identical, key order included.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SNMcqrfNyoLRQ7qXUFZnb9
Kjell Tore Guttormsen
95dea9ba90