💡 OWASP Agentic Top 10 Security Posture Scoring for the Agent Fleet

[github-actions[bot]]

Summary

Extend the compliance-auditor agent to score the org's agent fleet against the newly published OWASP Top 10 for Agentic Applications (2026), covering excessive agency (LLM06), privilege escalation via tool permissions, prompt injection surface area in PR comments and issue bodies, and supply chain integrity of MCP servers and action dependencies. Produce a machine-readable posture report and remediation checklist per agent profile.

Market Signal

OWASP published the Top 10 for Agentic Applications in 2026, specifically targeting autonomous AI agents with tool-use capabilities — exactly the profile of the pr-review and dev-lead agents. Prompt injection attacks increased 340% YoY per OWASP's June 2026 report. In Q1 2026, six major real-world agent vulnerabilities were disclosed (GrafanaGhost, ForcedLeak, GeminiJack, EchoLeak, Reprompt, and an OpenAI plugin supply chain attack). VentureBeat reported in June 2026 that three AI coding agents leaked secrets through a single prompt injection. The "Least-Agency" principle extends least-privilege to agent autonomy levels.

User Signal

The agent-shield.yml workflow exists but is marked as a thin caller stub that must not be modified beyond allowed inputs. Compliance-audit issues are frequent (open: #630, #629, #546, #544; recently closed: #547, #545, #439, #438, #398, #396, #395, #394, #393, #392, #391). These cover repo-level compliance (CODEOWNERS, actions pinning, secret scanning) but NOT agentic-specific risks like excessive tool permissions, prompt injection vectors in untrusted PR content, or MCP server supply chain integrity.

Technical Opportunity

The compliance-auditor agent (agents/compliance-auditor.md) already has the invocation pattern and reporting format. The OWASP Agentic Top 10 categories map cleanly to auditable properties:

1. Excessive Agency — audit tool permissions granted in workflow YAML vs. minimum required
2. Prompt Injection — audit input sanitization in review-one-pr.sh for untrusted PR content
3. Supply Chain — audit action SHA pins and MCP server source integrity
4. Insufficient Logging — audit TOKEN_LOG_FILE presence and decision record coverage
5. Insecure Output Handling — audit how agent outputs flow to PR comments (injection vectors)

Each check can be a shellcheck-style rule with pass/warn/fail scoring.

Assessment

Dimension	Score	Rationale
Feasibility	med	Requires mapping 10 abstract categories to concrete, automatable checks
Impact	high	Addresses a completely unaudited threat surface (agentic-specific risks)
Urgency	med	OWASP framework just published; threat landscape is escalating (340% YoY)

Adversarial Review

Strongest objection: OWASP frameworks tend to be generic checklists that generate noise without actionable findings. The compliance-auditor already produces a steady stream of compliance issues — adding another 10 categories risks audit fatigue and deprioritization of real threats.

Rebuttal: The existing compliance checks cover repo configuration (labels, CODEOWNERS, permissions). OWASP Agentic Top 10 covers a completely different threat surface: runtime agent behavior, tool permissions, and input handling. There is zero overlap — these are complementary. To prevent audit fatigue, implement as a scored posture report (0-100 per category) rather than individual issues, surfaced weekly alongside the Token Cost Observatory report. Only critical findings (score below 50) generate remediation issues.

Suggested Next Step

Map each OWASP Agentic Top 10 category to concrete, automatable checks against the agent fleet's workflow YAML, prompt files, and script inputs. Prototype the top 3 checks (Excessive Agency, Prompt Injection, Supply Chain) as a new compliance-auditor scoring mode.