mirror of
https://github.com/addyosmani/agent-skills.git
synced 2026-08-12 18:07:26 +02:00
Addy Osmani
d1983929db
Per nucliweb's review: - Resolve OWASP numbering inconsistency: rename the prevention section to "OWASP Top 10 Prevention Patterns" and drop the per-item numbers so it no longer implies a ranking that conflicts with the 2021 quick-reference table. - Harden the SSRF example against DNS rebinding/TOCTOU: resolve all records and reject if any is non-unicast, plus a caveat that fetch re-resolves and pointers to request-filtering-agent / ssrf-req-filter for high-risk surfaces. - Add LLM08 (Vector and Embedding Weaknesses) to the LLM section and the reference table, covering per-tenant embedding isolation and poisoned docs. - Promote "Threat Model First" to a "## Process" header per the repo's skill anatomy convention. - Make the LLM "GOOD" example parse defensively (JSON.parse + schema in a try/catch) so it models handling untrusted output end to end.