agent-security-review

Reviews AI agents, LLM-backed features, MCP servers, and prompt/skill/agent definitions for agentic-security risk. On-demand checklist: the lethal-trifecta test (private data × untrusted content × outbound channel), OWASP Top 10 for LLM Applications (2025) quick checks, a containment-first checklist, and MCP / tool-permission review. Breaks the trifecta rather than filtering it; treats every tool return value as untrusted. USE FOR: prompt injection, indirect prompt injection, tool output injection, lethal trifecta, agent security review, MCP security, OWASP LLM Top 10, LLM01, excessive agency, improper output handling, data exfiltration via agent, containment-first, egress allow-list, least-privilege agent, confused deputy, RAG poisoning. DO NOT USE FOR: building an MCP server (use mcp-builder), classic web/app AppSec with no LLM in the loop (use the security-reviewer agent), writing evals (use agent-evals).