Release v0.9.0 — OWASP LLM Top 10 2026 support + 5 new Agent Skill rules · akanthed/SecureAI-Scan

Support for the official OWASP Top 10 for LLM Applications 2026, plus five new Agent Skill detection rules — SKL006 through SKL010.

OWASP LLM Top 10 2026

Versioned reporting: JSON includes owaspVersion: "2026", terminal/CLI output uses the official LLMxx:2026 notation, Markdown/HTML name the framework version, and SARIF emits owasp-llm-top10-2026/* tags.
A conservative coverage statement (docs/OWASP2026.md) distinguishes implemented static signals from partial coverage and the runtime-only Misinformation boundary, instead of presenting category mapping as exhaustive detection.
Existing findings remapped to the official 2026 ranking (Excessive Agency → LLM03, Supply Chain → LLM04, Data/Model Poisoning → LLM05, Unbounded Consumption → LLM06, Misinformation → LLM07, Hidden Context Exposure → LLM08, Vector/Embedding Weaknesses → LLM09, Improper Output Handling → LLM10). Detection behavior and evidence tiers are unchanged.

SKL006 — load-time command execution via Claude Code's dynamic-context-injection syntax, which runs shell commands the instant a skill is read, before any tool-permission gate applies.
SKL007 — unscoped Bash/Bash(*) grants in a skill's allowed-tools frontmatter.
SKL008 — skills that fetch and execute instructions from an external URL at runtime instead of shipping them in the reviewed bundle.
SKL009 — skills that write into another trust-elevated context file (MEMORY.md, SOUL.md, AGENTS.md, CLAUDE.md), planting a backdoor that outlives the skill.
SKL010 — unsafe deserialization tags (e.g. YAML !!python/object) in skill-bundle metadata/config that execute code on load.

Validated against the real-repo regression corpus with no new false positives — see What we found scanning real repos for the full writeup.

Full Changelog: v0.8.0...v0.9.0