# AI Agent Security and Reliability Audit

Workflow: Demo - Unsafe Support Agent  
Score: 10/100 (F)

## Executive summary

The local static review found nine items: four high, four medium, and one low.

## Workflow inventory

- Nodes: 4 active, 4 total
- External input: Public Support Webhook
- Model node: Customer Support Agent
- Write-capable nodes: Send Account Email, Fetch Customer URL

## Selected findings

### AA-003 | HIGH | Untrusted input reaches a model

Evidence: `Public Support Webhook -> Customer Support Agent`

Recommended action: Add deterministic size, type, and allowlist validation before the model. Separate instructions from user data and test prompt injection cases.

Reference: OWASP LLM01 Prompt Injection

### AA-004 | HIGH | Model output reaches a write action without approval

Evidence: `Customer Support Agent -> Send Account Email`

Recommended action: Require explicit human approval before sending messages or changing external systems. Give the final action the smallest possible permission.

Reference: OWASP LLM06 Excessive Agency

### AA-002 | MEDIUM | Public webhook authentication is not enforced

Evidence: `Public Support Webhook` uses no native authentication.

Recommended action: Require header, JWT, or basic authentication at the webhook boundary. Reject invalid requests before processing and rate-limit failed attempts.

Reference: OWASP access control guidance

### AA-007 | HIGH | Workflow data controls an outbound URL

Evidence: `Public Support Webhook -> Customer Support Agent -> Send Account Email -> Fetch Customer URL`

Recommended action: Parse and allowlist destinations. Block private and metadata IP ranges. Disable redirects unless they are required.

Reference: SSRF boundary and OWASP LLM06 Excessive Agency

## Review limits

- Static analysis cannot prove runtime authorization, credential scopes, upstream controls, or model behavior.
- A clean report is not a penetration test or a security guarantee.
- Production permissions, prompts, logs, and failure handling still require manual review.

## Reference baseline

- OWASP Top 10 for LLM Applications 2025: https://genai.owasp.org/llm-top-10/
- OWASP Excessive Agency: https://owasp.org/www-project-top-10-for-large-language-model-applications/2_0_vulns/LLM06_ExcessiveAgency.html
- NIST AI RMF Generative AI Profile: https://doi.org/10.6028/NIST.AI.600-1