{
  "markdown": "# GenAI Security Advisor\n\n## Currently In Preview\n\nGet security guidance for Generative AI, LLMs, agents, MCP, and related technologies grounded in the published research of the **OWASP GenAI Security Project**.\n\nThe **GenAI Security Advisor** is an [Agent Skill](https://agentskills.io) that gives your AI coding assistant access to a curated, versioned knowledge base of OWASP GenAI Security Project research rather than relying only on the model's general knowledge.\n\nIt can help you research, assess, explain, and apply GenAI security guidance across areas including:\n\n- LLM security\n- Agentic AI security\n- Data security for GenAI\n- MCP security\n- AI red teaming\n- GenAI governance\n- Security frameworks and mappings\n- Secure AI adoption\n- Related OWASP GenAI Security Project research and guidance\n\n> **In short:** install the skill once, then ask your AI assistant GenAI security questions in your normal workflow.\n\n---\n\n## What can I use it for?\n\nOnce installed, you can ask your AI assistant questions such as:\n\n### Understand a security risk\n\n```text\nWhat are the primary security risks associated with prompt injection?\n```\n\n```text\nExplain the security risks of excessive agency in an AI agent.\n```\n\n```text\nWhat security concerns should I consider when using MCP?\n```\n\n### Assess an architecture\n\n```text\nReview this GenAI architecture and identify the security risks I should consider.\n```\n\n```text\nWhat GenAI security controls should I consider for an application\nthat uses an LLM with access to internal company data?\n```\n\n### Apply GenAI Security Project guidance\n\n```text\nHow does this application map to the OWASP LLM Top 10?\n```\n\n```text\nWhich OWASP GenAI security guidance applies to this AI agent?\n```\n\n```text\nWhat security controls should I implement to mitigate this risk?\n```\n\n### Compare risks and controls\n\n```text\nCompare the security risks of an LLM application and an autonomous AI agent.\n```\n\n```text\nWhat are the recommended mitigations for this GenAI security issue?\n```\n\n### Work with your code or design\n\nYou can provide code, architecture diagrams, configuration, requirements, or other project information and ask the Advisor to help identify relevant GenAI security considerations.\n\nFor example:\n\n```text\nReview this code for GenAI security risks and identify which\nOWASP GenAI guidance is relevant.\n```\n\n```text\nHere is the architecture for our AI agent. Identify potential\nsecurity risks and recommend mitigations.\n```\n\n---\n\n## Why use the GenAI Security Advisor?\n\nGenAI security guidance changes quickly. General-purpose AI models may have incomplete, outdated, or inconsistent knowledge of the latest OWASP GenAI Security Project research.\n\nThe Advisor addresses this by grounding its guidance in a **versioned, curated corpus of OWASP GenAI Security Project research**.\n\nThe corpus covers areas such as the LLM Top 10, Agentic Top 10, Data Security risk and framework mappings, MCP security, red teaming, and governance guidance.\n\nThe corpus is intentionally maintained as point-in-time copies rather than live links to upstream repositories. This means the guidance you receive does not unexpectedly change because an unrelated upstream document was modified.\n\n---\n\n# Getting Started\n\n## Choose your AI assistant\n\nThe GenAI Security Advisor works with multiple Agent Skill-compatible tools.\n\n| AI Assistant | Supported |\n|---|---|\n| Claude Code | Yes |\n| OpenAI Codex CLI | Yes |\n| GitHub Copilot | Yes |\n| Gemini CLI | Yes |\n\nThe skill uses the open [Agent Skills](https://agentskills.io) format, with a single canonical `SKILL.md` that can be discovered by supported platforms.\n\n---\n\n# Install the Skill\n\nTo install the skill use the method for your AI assistant.\n\n### Claude Code\n\nUse the repository's plugin marketplace:\n\n```text\n/plugin marketplace add GenAI-Security-Project/GenAI-Security-Advisor\n```\n\nThen install the skill:\n\n```text\n/plugin install\n```\n\nAlternatively, copy the skill into your Claude skills directory:\n\n```text\n~/.claude/skills/genai-security-advisor/\n```\n\n### OpenAI Codex CLI\n\nInstall the skill globally:\n\n```bash\nnpx skills add GenAI-Security-Project/GenAI-Security-Advisor -g\n```\n\nThe same installer can target multiple supported hosts, for example:\n\n```bash\nnpx skills add GenAI-Security-Project/GenAI-Security-Advisor \\\n  -g \\\n  -a codex \\\n  -a claude-code \\\n  -a copilot \\\n  -a gemini-cli\n```\n\n### Gemini CLI\n\nInstall the Gemini extension:\n\n```bash\ngemini extensions install https://github.com/GenAI-Security-Project/GenAI-Security-Advisor\n```\n\n### GitHub Copilot\n\nInstall the skill with the GitHub CLI:\n\n```bash\ngh skill install GenAI-Security-Project/GenAI-Security-Advisor\n```\n\nThe skill is installed into:\n\n```text\n~/.copilot/skills/\n```\n\nThe repository documents these platform-specific registration methods. Because AI coding tools and their CLI interfaces can change, check the current tool documentation or `--help` output if an installation command has changed.\n\n---\n\n# Using the Advisor\n\nOnce the skill is installed, you don't need to learn a new command language.\n\n**Just ask your AI assistant a GenAI security question.**\n\nFor example:\n\n```text\nWhat OWASP GenAI security guidance should I consider when\nbuilding an AI agent that can execute tools?\n```\n\nOr:\n\n```text\nReview this AI agent design and identify the security risks.\nFor each risk, explain the relevant OWASP guidance and\nrecommended mitigations.\n```\n\nOr:\n\n```text\nI'm building an MCP-enabled application. What security\ncontrols should I consider?\n```\n\nThe skill determines which research resources are relevant and uses the included corpus to ground its response.\n\n---\n\n# Getting Better Answers\n\nThe more context you provide, the more useful the Advisor can be.\n\nInstead of:\n\n```text\nHow do I secure AI?\n```\n\nTry:\n\n```text\nI'm building an internal enterprise application that uses an LLM\nto summarize confidential documents. The model can retrieve\ndocuments from our internal knowledge base.\n\nWhat are the key GenAI security risks I should consider?\nMap the risks to relevant OWASP GenAI guidance and recommend\npractical mitigations.\n```\n\nUseful context can include:\n\n- Your application architecture\n- The type of AI model you're using\n- Whether you're using agents\n- Tools available to the model or agent\n- Data sources\n- Authentication and authorization mechanisms\n- MCP servers\n- External APIs\n- Deployment environment\n- Trust boundaries\n- Security requirements\n- Code or configuration\n\n---\n\n# Ask for Evidence and Sources\n\nWhen security guidance matters, you can ask the Advisor to explain where its recommendation comes from.\n\nFor example:\n\n```text\nWhich OWASP GenAI Security Project resource supports this recommendation?\n```\n\n```text\nShow me the relevant OWASP GenAI security guidance for each risk.\n```\n\n```text\nExplain how this recommendation maps to the OWASP LLM Top 10.\n```\n\nThis can help you distinguish OWASP GenAI Security Project guidance from general security recommendations.\n\n---\n\n# What is included?\n\nThe repository contains the skill itself and a curated research corpus.\n\n## `SKILL.md`\n\nThis is the Agent Skill's instruction set. It tells your AI assistant how to use the GenAI Security Advisor and how to work with the included research.\n\nThere is one canonical `SKILL.md` at the repository root. Platform-specific paths point back to this canonical version.\n\n## `corpus/`\n\nThis contains the research resources used by the Advisor.\n\nThe resources are maintained as frozen, point-in-time copies so that the Advisor's knowledge does not unexpectedly change when an upstream repository changes.\n\nThe `corpus/MANIFEST.yaml` file provides information about the resources included in the corpus, including their status and licensing.\n\n---\n\n# Keeping the Advisor Current\n\nThe research corpus is intentionally versioned.\n\nUpdates to upstream OWASP GenAI Security Project resources are not automatically pulled into your installation. Updates are reviewed and incorporated into the Advisor's corpus deliberately.\n\nThis design provides a more predictable experience: the guidance you're using is tied to a known version of the Advisor rather than silently changing underneath you.\n\nWhen a new version of the Advisor is released, update your installed skill using the update mechanism provided by your AI assistant.\n\n---\n\n# Important: This is Security Guidance\n\nThe GenAI Security Advisor is intended to help you understand and apply GenAI security research and guidance.\n\nIt should **not** be treated as a substitute for:\n\n- Your organization's security policies\n- Security architecture review\n- Threat modeling\n- Penetration testing\n- Legal or regulatory review\n- Risk acceptance processes\n- Professional security expertise\n\nUse the Advisor as a research and decision-support tool, and validate recommendations against your specific environment and requirements.\n\n---\n\n---\n\n# Contributing and Asking Questions\n\nThe GenAI Security Advisor is an open project and welcomes contributions from the community.\n\n## Ask a Question\n\nIf you have questions about using the GenAI Security Advisor, installing the skill, interpreting its guidance, or getting started, join the **OWASP GenAI Security Project Slack** and use the:\n\n**`#team-genai-security-advisor`** channel\n\nThis is the recommended place to ask questions, discuss how the Advisor works, and connect with others using or contributing to the GenAI Advisor project.\n\n## Contribute\n\nContributions are welcome, including:\n\n- Improving the Agent Skill instructions\n- Adding or improving examples\n- Identifying gaps or issues in the research corpus\n- Suggesting additional OWASP GenAI Security Project resources\n- Improving documentation\n- Reporting bugs or unexpected behavior\n- Proposing enhancements to the Advisor\n\nBefore making a contribution, consider discussing the proposed change in **`#team-genai-security-advisor`** so the community can provide feedback and help coordinate the work.\n\nWhen contributing research or other material to the corpus, please review the applicable licensing information in `corpus/MANIFEST.yaml` and preserve the original licensing requirements.\n\n---\n\n# Licensing\n\nThe GenAI Security Advisor repository contains both project-owned content and third-party research content.\n\nThe repository's own content—including `SKILL.md`, scripts, workflow files, manifest files, and this README—is licensed under **Apache-2.0**.\n\nContent in `corpus/` retains its original license. Much of the included OWASP GenAI Security Project content is licensed under **CC BY-SA 4.0**.\n\nIf you redistribute material from the corpus, check `corpus/MANIFEST.yaml` for the applicable license for each resource.\n\n---\n\n# Version\n\nThe current public release is **v1.1.0**.\n\nThe project follows Semantic Versioning. See [`CHANGELOG.md`](./CHANGELOG.md) for release history.\n\n---\n\n# Learn More\n\n- [OWASP GenAI Security Project](https://genai.owasp.org)\n- [Agent Skills](https://agentskills.io)\n- [`SKILL.md`](./SKILL.md)\n- [`CHANGELOG.md`](./CHANGELOG.md)\n- [`corpus/MANIFEST.yaml`](./corpus/MANIFEST.yaml)\n\n---\n\n## Quick Start\n\nIf you just want to get started:\n\n1. **Install the GenAI Security Advisor** for your AI assistant.\n2. **Open your project** in that AI assistant.\n3. **Ask a GenAI security question.**\n4. **Provide your architecture, code, or other context** when you want a more specific assessment.\n5. **Ask for the relevant OWASP guidance and mitigations** when you need to understand the basis for a recommendation.\n\nThat's it.\n\n**The GenAI Security Advisor brings OWASP GenAI Security Project research into the AI-assisted development workflow you're already using.**\n",
  "bytes": 11600,
  "sha": "266de7bafb7d7306aa407e1647accaf97dcd5b13dc07ab5ba921e171c38dbad4",
  "repo_slug": "genai-security-project/genai-security-advisor",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_genai_security_project_genai_security_ad_76200352/readme"
}