OWASP Top 10 Applicability

OWASP Top 10 Applicability

SECURITY.md and Threat Model are Clio's primary security documents. This page answers a specific question a security reviewer will ask: how does Clio map to the OWASP Top 10 for LLM Applications (2025) and the OWASP Top 10 for Agentic Applications (2026)?

The short answer: most of both lists does not apply, because Clio does not invoke a large language model and is not an agent. Documenting why is more honest — and more useful — than forcing a mapping. A checklist that reports "mitigated" against risks a tool cannot have is noise, not assurance.

What Clio is, in OWASP terms

Clio is a browser extension that reads an already-rendered conversation out of the DOM of three chat sites and writes it to local JSON. This is verifiable from the code:

• It makes no call to any LLM or model API — there is no inference in Clio. It reads text the provider has already rendered.
• It sends no conversation content to any server — strict-local processing, no telemetry (CONTRIBUTING.md, PRIVACY.md).
• Its host_permissions are scoped to exactly the three supported chat origins plus googleusercontent.com for image fetches — see Defense in Depth.

Because no model ever runs, the failure modes the OWASP LLM list enumerates — prompt injection into a model, model/data poisoning, system-prompt leakage, embedding attacks, model-driven misinformation, model resource exhaustion — have no surface in Clio. And because Clio has no autonomy, tools, memory, or planning loop, the OWASP Agentic list does not apply at all.

LLM Top 10 (2025) — item by item

ID	Item	Applies to Clio?
LLM01	Prompt Injection	No — Clio sends no prompt to a model. The nearest analog is a hostile DOM feeding Clio attacker-controlled HTML; that is an integrity concern covered in Threat Model §3, not prompt injection.
LLM02	Sensitive Information Disclosure	Partially — and this is the one that matters. The data Clio handles (your AI conversations) is sensitive. Clio's entire design is the mitigation: strict-local, no transmission, no telemetry. See Privacy Architecture and User Data Sovereignty.
LLM03	Supply Chain	Yes, in the software sense. A malicious dependency or a compromised Chrome Web Store update is a real risk — covered as Threat Model §1 (contributor side-channel) and §4 (malicious update), with a minimal-permission blast-radius cap. Not LLM-specific, but genuine.
LLM04	Data & Model Poisoning	No — no training, fine-tuning, or embedding data exists in Clio.
LLM05	Improper Output Handling	Marginal. Clio's output is inert local JSON, never executed. The integrity of that JSON under a hostile DOM is addressed in Threat Model §3.
LLM06	Excessive Agency	No — Clio has no agency: no tools, no autonomous actions, a single user-initiated read.
LLM07	System Prompt Leakage	No — there is no system prompt; Clio does not prompt a model.
LLM08	Vector & Embedding Weaknesses	No — no vectors, embeddings, or RAG.
LLM09	Misinformation	No (for Clio itself) — Clio generates nothing; it copies what the provider already rendered. Fidelity of that copy is an integrity property — see Provenance and Auditability.
LLM10	Unbounded Consumption	No — there is no server-side model or inference to exhaust; processing is local and bounded by a single conversation.

Agentic Top 10 (2026) — Not Applicable

ASI01–ASI10 (goal hijack, tool misuse, identity & privilege abuse, agentic supply chain, unexpected code execution, memory & context poisoning, insecure inter-agent communication, cascading failures, human-agent trust exploitation, rogue agents) all presuppose an autonomous, tool-using agent. Clio is a single-shot, user-initiated DOM reader with no tools, no memory, and no planning loop. None of the agentic risks have a surface here. Documenting that plainly is the correct posture — the alternative (claiming controls against threats the design forecloses) would be misleading.

The frameworks that DO fit Clio

Clio's real security posture is a browser-extension and CIA-triad story, and it is documented where it belongs:

• Minimal permissions, Manifest V3 CSP, isolated-world content scripts, no remote code — Defense in Depth
• Confidentiality / Integrity threat actors and mitigations — Threat Model
• Availability / denial-of-access (a distinct threat-actor profile) — Availability and Denial of Access
• The formal document — SECURITY.md

Related

• Threat Model
• Defense in Depth
• Privacy Architecture
• SECURITY.md