Menu

Individual skill

securing-agentic-ai-tool-invocation

0upvotes

Implements defense-in-depth controls at an AI agent's tool-invocation boundary using tool allowlisting, least-privilege identity binding, NeMo Guardrails policy enforcement, human-in-the-loop approval, and audit logging. Use when hardening an agent that calls tools with real side effects (email, payments, file writes, code execution), mapping OWASP Agentic AI Top 10 controls, or bounding prompt-injection blast radius.

skills/securing-agentic-ai-tool-invocation/SKILL.md

Read pinned source

Source commit 54a798831d2266a3ca61ce68a7acb80b81160d57

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Network or broad shell
Last checked
Nov 9, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
35,875
Repository last updated
Aug 31, 2026
License
Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt
# Securing Agentic AI Tool Invocation

> **Authorized-use-only notice:** This is a defensive skill. The controls below govern how an AI agent invokes tools/plugins. Deploy them on systems you own or operate. Test guardrail bypasses only against your own agent in a non-production environment.

## Overview

Autonomous (agentic) AI systems decide *which tool to call, with what arguments, and when*, based on model reasoning over untrusted inputs. That makes the tool-invocation boundary the highest-risk control point in an agent: a single successful prompt injection or a poisoned tool can turn the agent into a confused deputy that deletes data, sends money, or pivots into connected systems. The relevant threat is MITRE ATLAS **AML.T0053 (LLM Plugin Compromise)** and the OWASP **Agentic AI Top 10** classes for *Tool Misuse*, *Excessive Agency*, and *Privilege Compromise*.

The defense is layered, defense-in-depth governance of tool calls: (1) a strict **allowlist** of which tools the agent may call and with which argument shapes; (2) **least-privilege identity binding** so each tool call runs with scoped, short-lived credentials tied to the acting user/session — not a single god-mode service account; (3) **policy enforcement** at the call boundary (NVIDIA **NeMo Guardrails** dialog/flow rails and `tool` guardrails, or a deterministic policy wrapper); (4) **human-in-the-loop (HITL)** approval for high-impact actions; and (5) **audit logging** of every invocation for detection. This skill implements all five with verified, runnable patterns using NeMo Guardrails and a framework-agnostic Python policy wrapper.

## When to Use

- When building or hardening an agent that can call tools with real-world side effects (email, payments, file writes, infra changes, code execution).
- When mapping OWASP Agentic AI Top 10 controls onto an existing agent framework.
- When you need to bound the blast radius of prompt injection / tool poisoning.
Back to top