Check an LLM or agent app against the OWASP LLM Top 10

openaudit checks three of the ten risks automatically: LLM01 Prompt Injection, LLM03 Supply Chain and LLM06 Excessive Agency. All three come from one auditor, code.agent-config, which reads the AI agent configuration committed to your repo. The other seven aren't checked automatically, so plan a manual review for them.

Coverage by category

What the tagged checks look at

The LLM checks read files. They don't call your model, send test prompts or watch a running app.

For LLM01, code.agent-config scans AGENTS.md, GEMINI.md and the Cursor, Copilot, Windsurf and Cline rule files. It flags instructions hidden in HTML comments, collapsed <details> blocks and hidden elements, and invisible, zero-width or bidirectional Unicode that a reviewer won't see but an agent will read. A file it can't read in full gets instruction-file-unscanned, so a gap is reported instead of skipped.

For LLM03, it flags MCP servers launched from an npm or PyPI package, or a Docker image, with no exact version.

For LLM06, it flags committed settings that give an agent more power than it needs: every Bash command pre-approved, Claude Code's bypassPermissions, a Codex config that disables the sandbox, all project MCP servers approved without a prompt, or a Gemini CLI server marked trust: true. It also flags instruction files that tell the agent to skip its safety controls.

code.unicode scans all code and docs for hidden Unicode. Its tag-characters rule carries a prompt-injection tag, but no owasp-llm01 tag.

What it doesn't cover

Your app's own prompts, retrieval pipeline and model output aren't in scope. openaudit has no check for system prompt leakage, poisoned training or RAG data, embedding store access, unsafe use of model output, hallucinated answers, or token and cost limits. The agent.injection and agent.authz playbooks review your code as ordinary code. They aren't written for LLM risks, and their findings carry no LLM tags.

How to run it

Run only the LLM-tagged checks:

bunx @openaudit/cli . --only code.agent-config

Write an HTML report next to a full audit:

bunx @openaudit/cli . -f html -o report

List the LLM findings from the JSON report with jq:

bunx @openaudit/cli . --json --only code.agent-config \
  | jq '[.results[].findings[] | select(any(.tags[]?; startswith("owasp-llm"))) | {ruleId, tags}]'

Add --fail-on high in CI to exit 1 on high or critical findings.

Finding the mapping in the report

The report's OWASP and CWE view lists the OWASP Top 10 (2021) and the CWE Top 25 (2024). It has no LLM Top 10 list. To see LLM findings:

• Open a finding. Its Tags list shows owasp-llm01, owasp-llm03 or owasp-llm06, and its References link to the matching OWASP GenAI risk page.
• Type owasp-llm in the findings search box. It matches tag text.
• In SARIF output the tags land in each result's properties, so code scanning tools can filter on them.

The hidden Unicode findings also carry cwe-451, so they show up under A04 Insecure Design in the OWASP view.

Next steps

• CLI flags
• Reading the report
• Running in CI
• Agents and MCP setup
• All auditors