open/llm-security
1
0
Fork 0
Code Issues Releases 1 Activity
llm-security/mapping/owasp-map.json
Kjell Tore Guttormsen 9b95fc607e Squashed 'scanners/commons/' changes from 0ffee85..532d70d 
532d70d release(0.2.0): the contract gained a MUST, so the tag has to move
946f51d fix(active-content,conformance): cite line numbers per commit — they do not resolve at the pin
bdcb1f1 feat(conformance): ship the six active-content cases; the id space already existed
807c0d4 feat(spec): add not-applicable, so a single-runtime table stops reading as 7 defects
a1578e6 fix(conformance): record the guard's internal-surface position on _LEX_PAYLOADS
4d351d2 fix(mapping): state that three of four OWASP maps have no production consumer
f082a91 fix(lexicon,docs): retract the claim that the guard's port cites severity.mjs

git-subtree-dir: scanners/commons
git-subtree-split: 532d70d5ed2f9b23a8efad760ef490356cf52ada
2026-08-11 13:02:33 +02:00

381 lines
14 KiB
JSON
Raw Blame History

{
"version": "0.2.1",
"id": "owasp-map",
"description": "Finding-id prefix to OWASP taxonomy codes, in four parallel maps. Every map is keyed by the same 16 scanner prefixes, so a finding carrying a prefix can be placed in whichever taxonomy a report is written against. An empty array means the seed implementation deliberately maps that prefix to nothing in that taxonomy - it is data, not a gap to fill.",
"$comment": "Extracted without behaviour change from llm-security/scanners/lib/severity.mjs (OWASP_MAP, OWASP_AGENTIC_MAP, OWASP_SKILLS_MAP, OWASP_MCP_MAP). Seeded 2026-08-09 from an operator dump; re-verified the same day directly against the module file at commit b0de0ca on the public remote, which is why source_commit is now pinned and the dump-fidelity caveat is gone. The dump states that a fallback map inside one of llm-security's own agent definitions covers only part of the prefix set; that is known drift in the consumer and is explicitly NOT inherited here. The maps below are the complete 16-prefix set from severity.mjs.",
"provenance": {
"source_repo": "llm-security",
"source_files": [
"scanners/lib/severity.mjs"
],
"source_exports": [
"OWASP_MAP",
"OWASP_AGENTIC_MAP",
"OWASP_SKILLS_MAP",
"OWASP_MCP_MAP"
],
"source_delivery": "operator dump 2/2, coord message from llm-security, 2026-08-09; superseded by a direct read of the module at the pinned commit below",
"source_commit": "b0de0ca6d86ce697f39669d177c2c2654c280128",
"source_remote": "ssh://git@git.fromaitochitta.com/open/llm-security.git",
"verified": "differentially, against the module file at b0de0ca - all four maps, key order, codes_used and unmapped_prefixes reproduced mechanically and compared, 2026-08-09",
"evidence_limits": [
"What each scanner prefix MEANS was not supplied. The prefixes are reproduced as opaque keys; no expansion of UNI, ENT, PRM and the rest is invented here.",
"The taxonomy_name strings are the identity of an external standard, not data read out of severity.mjs - the module names no edition anywhere. They were supplied by llm-security and, for the LLM/agentic/skills maps, cross-read against that repo's knowledge/ documents; only the MCP edition and status were additionally confirmed against the OWASP project page. A consumer that disagrees about which edition a code belongs to should raise it here rather than renumber locally.",
"Whether each of the four maps has a production consumer in llm-security was not measured here. llm-security reports (repo-wide grep on their side, coord message 2026-08-10T12:38:19Z) that OWASP_MAP is read by running code only as a fallback when a finding lacks an owasp field, and that OWASP_AGENTIC_MAP, OWASP_SKILLS_MAP and OWASP_MCP_MAP have no production consumer at all - only tests and golden artefacts reference them. If that holds, this file's top-level $comment 'Extracted without behaviour change' is vacuously true for three of the four maps: there is no running behaviour to have preserved, not a verified absence of change in one."
]
},
"prefixes": {
"$comment": "The 16 finding-id prefixes, in source order. All four maps carry exactly these keys in exactly this order; verified, not assumed. Meanings were not supplied and are not invented - a consumer resolves a prefix against the producing scanner, not against this file.",
"keys": [
"UNI",
"ENT",
"PRM",
"DEP",
"TNT",
"GIT",
"NET",
"TFA",
"MCI",
"MEM",
"SCR",
"PST",
"WFL",
"TRG",
"SIG",
"AST"
],
"count": 16
},
"open_questions": [
{
"id": "taxonomy-edition-unstated",
"question": "Which edition of each OWASP taxonomy do these codes refer to?",
"why_it_matters": "OWASP's Top 10 for LLM Applications was renumbered between editions: in the 2025 edition LLM06 is Excessive Agency, and entries present in the earlier list were consolidated into other numbers, with System Prompt Leakage and Vector and Embedding Weaknesses added as LLM07 and LLM08. A bare code such as LLM06 therefore does not identify a risk on its own. Two runtimes can reproduce this map perfectly and still publish reports that disagree about what a finding means, which is precisely the failure this repository exists to prevent.",
"status": "closed 2026-08-09 - answered by llm-security in the coord mailbox and written into taxonomy_name on each of the four maps below",
"resolution": "Three of the four are OWASP editions and are named as such. The fourth, OWASP_SKILLS_MAP, is not an OWASP taxonomy at all despite the constant name - see the skills entry. The edition question is therefore answered, but two narrower ones took its place and are recorded as open_questions below rather than folded away."
},
{
"id": "mcp-codes-may-move",
"question": "Are the MCP codes stable enough to treat as a contract?",
"why_it_matters": "The OWASP MCP Top 10 is an Incubator project in Phase 3 (Beta Release and Pilot Testing), published as 2025 v0.1, with continuous improvement scheduled from October 2026. Category numbering can still shift. A consumer that pins a report format to MCP01-MCP10 is pinning to a moving target, and the mapping in this file will need a version bump when it moves.",
"status": "open - accepted risk, no action available here",
"resolution_shape": "Re-read the OWASP project page when the beta closes and bump this file if numbering changed."
},
{
"id": "mcp06-name-divergence",
"question": "What is MCP06 called?",
"why_it_matters": "OWASP names MCP06:2025 'Intent Flow Subversion'. llm-security's knowledge/mcp-threat-patterns.md:7 calls it 'Prompt Injection'. MCP06 is the most heavily used MCP code in this map (six prefixes), so the two runtimes could agree perfectly on the code and still print different risk names in a report. The same divergence exists in shorter form on MCP02 ('Privilege Escalation via Scope Creep' vs 'Privilege Escalation') and MCP10 ('Context Injection & Over-Sharing' vs 'Context Over-Sharing'), where the shortened names are at least recognisably the same risk.",
"status": "open - reported here, to be fixed in llm-security's knowledge document",
"resolution_shape": "This file carries codes, not names, so nothing here changes. Fixed by llm-security aligning its reference document, or by this file growing a code-to-name table if consumers need one."
}
],
"taxonomies": {
"llm": {
"source_export": "OWASP_MAP",
"code_prefix": "LLM",
"taxonomy_name": "OWASP Top 10 for LLM Applications 2025",
"taxonomy_owner": "OWASP GenAI Security Project",
"taxonomy_status": "published",
"taxonomy_name_evidence": "Stated by llm-security 2026-08-09; the title line of that repo's knowledge/owasp-llm-top10.md at b0de0ca reads 'OWASP Top 10 for LLM Applications (2025)' and its LLM06 entry is Excessive Agency, which is the 2025 numbering.",
"codes_used": [
"LLM01",
"LLM02",
"LLM03",
"LLM06"
],
"unmapped_prefixes": [],
"map": {
"UNI": [
"LLM01"
],
"ENT": [
"LLM01",
"LLM03"
],
"PRM": [
"LLM06"
],
"DEP": [
"LLM03"
],
"TNT": [
"LLM01",
"LLM02"
],
"GIT": [
"LLM03"
],
"NET": [
"LLM02",
"LLM03"
],
"TFA": [
"LLM01",
"LLM02",
"LLM06"
],
"MCI": [
"LLM01",
"LLM02"
],
"MEM": [
"LLM01"
],
"SCR": [
"LLM03"
],
"PST": [
"LLM01",
"LLM06"
],
"WFL": [
"LLM02",
"LLM06"
],
"TRG": [
"LLM06"
],
"SIG": [
"LLM03",
"LLM02"
],
"AST": [
"LLM01",
"LLM02"
]
}
},
"agentic": {
"source_export": "OWASP_AGENTIC_MAP",
"code_prefix": "ASI",
"taxonomy_name": "OWASP Top 10 for Agentic AI Applications 2026",
"taxonomy_owner": "OWASP GenAI Security Project",
"taxonomy_status": "published",
"taxonomy_name_evidence": "Stated by llm-security 2026-08-09 as the ASI list from the December 2025 release; the title line of that repo's knowledge/owasp-agentic-top10.md at b0de0ca reads 'OWASP Top 10 for Agentic AI Applications (2026)' and names the prefix ASI (Agentic Security Issue).",
"codes_used": [
"ASI01",
"ASI02",
"ASI03",
"ASI04",
"ASI05"
],
"unmapped_prefixes": [
"TRG",
"AST"
],
"map": {
"UNI": [
"ASI01"
],
"ENT": [
"ASI01",
"ASI04"
],
"PRM": [
"ASI02",
"ASI03"
],
"DEP": [
"ASI04"
],
"TNT": [
"ASI01",
"ASI05"
],
"GIT": [
"ASI04"
],
"NET": [
"ASI02",
"ASI05"
],
"TFA": [
"ASI01",
"ASI02",
"ASI05"
],
"MCI": [
"ASI01",
"ASI04"
],
"MEM": [
"ASI01",
"ASI02"
],
"SCR": [
"ASI04"
],
"PST": [
"ASI02",
"ASI03",
"ASI04",
"ASI05"
],
"WFL": [
"ASI04"
],
"TRG": [],
"SIG": [
"ASI04"
],
"AST": []
}
},
"skills": {
"source_export": "OWASP_SKILLS_MAP",
"code_prefix": "AST",
"taxonomy_name": "llm-security AST (AI Skills Threat) - repo-owned, unversioned",
"taxonomy_owner": "llm-security",
"taxonomy_status": "not an OWASP taxonomy",
"taxonomy_name_evidence": "Stated by llm-security 2026-08-09: no OWASP edition exists, AST is not an OWASP product despite the OWASP_SKILLS_MAP constant name, and the constant name is a known misnomer they own. Confirmed by reading knowledge/owasp-skills-top10.md at b0de0ca, whose title is 'AI Skills Top 10 (AST)' and whose source line reads 'Derived from Snyk ToxicSkills research (Feb 2026), ClawHavoc campaign (Jan 2026), skill-scanner-agent threat model, and cross-mapped to OWASP LLM Top 10 and Agentic Top 10.' The cross-mapping is to OWASP; the taxonomy is not.",
"taxonomy_warning": "Do not present AST codes as OWASP codes in a report, and do not infer an OWASP edition for them. The source_export name is the only thing here that says OWASP, and it is wrong.",
"codes_used": [
"AST01",
"AST02",
"AST03",
"AST04",
"AST05",
"AST06"
],
"unmapped_prefixes": [
"WFL",
"SIG"
],
"map": {
"UNI": [
"AST05"
],
"ENT": [
"AST02",
"AST05"
],
"PRM": [
"AST03"
],
"DEP": [
"AST06"
],
"TNT": [
"AST01",
"AST02"
],
"GIT": [
"AST06"
],
"NET": [
"AST02"
],
"TFA": [
"AST01",
"AST02",
"AST03"
],
"MCI": [
"AST01",
"AST02"
],
"MEM": [
"AST01",
"AST05"
],
"SCR": [
"AST06"
],
"PST": [
"AST01",
"AST03"
],
"WFL": [],
"TRG": [
"AST04"
],
"SIG": [],
"AST": [
"AST02"
]
}
},
"mcp": {
"source_export": "OWASP_MCP_MAP",
"code_prefix": "MCP",
"taxonomy_name": "OWASP MCP Top 10 2025",
"taxonomy_owner": "OWASP",
"taxonomy_status": "beta - Incubator project, Phase 3 (Beta Release and Pilot Testing), published as 2025 v0.1",
"taxonomy_name_evidence": "Stated by llm-security 2026-08-09 as 'OWASP MCP Top 10 2025' with codes written MCP01:2025 through MCP10:2025, together with the caveat that the project is officially OWASP but still in beta so the codes can move. Both the edition label and the Phase 3 beta status were independently confirmed against https://owasp.org/www-project-mcp-top-10/ on 2026-08-09 - this is the only taxonomy in this file checked against the standards body rather than only against the consumer.",
"taxonomy_warning": "Codes are provisional. See open_questions mcp-codes-may-move and mcp06-name-divergence.",
"codes_used": [
"MCP01",
"MCP02",
"MCP03",
"MCP04",
"MCP05",
"MCP06",
"MCP07",
"MCP09",
"MCP10"
],
"unmapped_prefixes": [
"WFL",
"TRG",
"SIG",
"AST"
],
"map": {
"UNI": [
"MCP06"
],
"ENT": [
"MCP01",
"MCP06"
],
"PRM": [
"MCP02",
"MCP07"
],
"DEP": [
"MCP04"
],
"TNT": [
"MCP05",
"MCP06"
],
"GIT": [
"MCP04"
],
"NET": [
"MCP02",
"MCP10"
],
"TFA": [
"MCP03",
"MCP06"
],
"MCI": [
"MCP03",
"MCP06",
"MCP09"
],
"MEM": [
"MCP05",
"MCP06"
],
"SCR": [
"MCP04"
],
"PST": [
"MCP02",
"MCP07"
],
"WFL": [],
"TRG": [],
"SIG": [],
"AST": []
}
}
},
"totals": {
"taxonomies": 4,
"prefixes": 16,
"entries": 64
}
}
Reference in a new issue View git blame Copy permalink