OWASP Top 10 Alignment
The OWASP Top 10 for LLM Applications (2025) is the industry-standard framework for understanding security risks in AI and large language model applications. CrabShield is designed to address these risks comprehensively.
This page maps each OWASP risk to the CrabShield guards that mitigate it.
If you're not familiar with OWASP, the key takeaway is that independent security researchers identified the top 10 risks for AI applications, and CrabShield addresses all of them. For a more accessible introduction to CrabShield's protections, see the Security Overview.
At a Glance
| OWASP Risk | CrabShield Coverage |
|---|---|
| LLM01: Prompt Injection | Prompt Injection, Memory Guard |
| LLM02: Sensitive Information Disclosure | Credential Vault, System Prompt Leakage |
| LLM03: Supply Chain | Skill Verification, MCP Hardening |
| LLM04: Data Poisoning | Memory Guard, Config Tamper Detection |
| LLM05: Improper Output Handling | Output Scanner |
| LLM06: Excessive Agency | Tool Gate, Filesystem Fence, Network Policy, Anomaly Detection |
| LLM07: System Prompt Leakage | System Prompt Leakage |
| LLM08: Vector and Embedding Weaknesses | Memory Guard, Prompt Injection, RAG Scanner |
| LLM09: Misinformation | Output Scanner, Audit & Alerts |
| LLM10: Unbounded Consumption | Input Validator, Tool Gate |
LLM01: Prompt Injection
The risk: Crafted inputs that manipulate an AI agent into ignoring its instructions, revealing sensitive data, or taking unauthorized actions.
How CrabShield helps:
- Prompt Injection scans every incoming message for manipulation attempts, including direct attacks, encoded payloads, role-play exploits, and multi-turn escalation spread across messages
- Memory Guard catches injection attempts hidden in recalled context, preventing attackers from planting instructions that activate later
LLM02: Sensitive Information Disclosure
The risk: AI agents unintentionally exposing personal data, credentials, API keys, or proprietary information in their responses.
How CrabShield helps:
- Credential Vault scans both input and output for API keys, passwords, tokens, connection strings, and PII, redacting them before they can leak
- System Prompt Leakage monitors agent responses for system prompt content and flags when instructions are being exposed
- Filesystem Fence prevents agents from reading sensitive files like
.envthat contain credentials
LLM03: Supply Chain
The risk: Compromised components such as plugins, skills, MCP servers, or dependencies introducing vulnerabilities or malicious behavior.
How CrabShield helps:
- Skill Verification requires cryptographic signatures on all skills and continuously re-verifies them at runtime to catch tampering
- MCP Hardening enforces an allowlist of approved MCP servers and inspects their responses for manipulation attempts
LLM04: Data Poisoning
The risk: Manipulation of data used by the AI (training data, fine-tuning data, or stored context) to influence behavior.
How CrabShield helps:
- Memory Guard scans recalled context and stored memories for injected instructions that could alter agent behavior
- Config Tamper Detection monitors critical configuration files for unauthorized modifications that could change agent behavior
LLM05: Improper Output Handling
The risk: AI-generated outputs containing dangerous code (SQL injection, XSS, command injection) that gets executed by downstream systems without validation.
How CrabShield helps:
- Output Scanner checks every agent response for dangerous code patterns before the response reaches the user or downstream systems
LLM06: Excessive Agency
The risk: AI agents with too much autonomy, taking actions beyond their intended scope through access to dangerous tools, unchecked file operations, or unrestricted network access.
How CrabShield helps:
- Tool Gate controls exactly which tools an agent can use, blocks dangerous tools by default, enforces rate limits, and detects suspicious tool usage patterns
- Filesystem Fence restricts file access to the agent's workspace and protects sensitive files
- Network Policy controls outbound network access, blocking requests to private networks and internal services
- Escalation Detection catches commands that attempt to gain elevated system privileges
- Anomaly Detection flags an agent whose tool usage suddenly deviates far from its normal pattern
LLM07: System Prompt Leakage
The risk: System prompts containing sensitive rules, configurations, or internal information being exposed to users.
How CrabShield helps:
- System Prompt Leakage is purpose-built for this risk. It detects extraction attempts in user messages and monitors agent responses for leaked prompt content. It also scans system prompts themselves for accidentally embedded credentials.
LLM08: Vector and Embedding Weaknesses
The risk: Attacks targeting RAG (retrieval-augmented generation — systems where AI retrieves documents to help answer questions) systems by injecting malicious content into vector stores (how AI systems store and search through document collections) or manipulating retrieval results.
How CrabShield helps:
- Memory Guard scans retrieved context for injection patterns before the agent processes it
- Prompt Injection catches manipulation attempts regardless of whether they come from user input or retrieved documents
- RAG Scanner scans documents at upload time, before they ever reach your Knowledge Base, catching hidden instructions and document-specific concealment tricks
LLM09: Misinformation
The risk: AI agents generating false, misleading, or harmful content that users trust and act on.
How CrabShield helps:
- Output Scanner catches responses containing dangerous or insecure code patterns that could cause harm if followed
- Audit & Alerts provides complete logging for monitoring and reviewing agent behavior over time
Misinformation is primarily an AI model quality issue rather than a security issue. CrabShield focuses on the security aspects (catching dangerous outputs) while model selection, fine-tuning, and grounding strategies address factual accuracy.
LLM10: Unbounded Consumption
The risk: Uncontrolled resource usage through oversized inputs, excessive requests, or runaway processing that leads to service disruption or unexpected costs.
How CrabShield helps:
- Input Validator enforces message size limits and per-channel rate limiting
- Tool Gate limits tool call rates and caps destructive actions per session
- Memory Guard enforces session size limits to prevent unbounded context growth