aveproject/ave
Security testingこのページは AI により自動翻訳されています。技術的な詳細は原文をご確認ください。 原文を見る
AVE - Agentic Vulnerability Enumeration. The open behavioral classification standard for agentic AI components.
概要
Stable IDs, AIVSS scores, and behavioral fingerprints for every way a skill file, MCP server, system prompt, or agent plugin can be weaponized — scored consistently, mapped to the frameworks security teams already report against. Skill files, MCP server manifests, and system prompts are executable instructions, not documentation. Any process that loads them runs them. There is no compiler, no type checker, no sandbox. The runtime is an LLM that reads natural language and acts on it. Existing vulnerability standards were built for conventional software. CVE identifies flaws in a specific product and version. OSV maps them to package and version ranges. Neither can describe a prompt injection hidden in an MCP tool description — there is no package, no version, no vulnerable dependency. The danger is in what the component does, not what it imports. It assigns stable identifiers to distinct behavioral classes in agentic AI, scores them with OWASP AIVSS v0.
README
以下は原文 README の抜粋です。原文を見る。
What is AVE?
Skill files, MCP server manifests, and system prompts are executable instructions, not documentation. Any process that loads them runs them. There is no compiler, no type checker, no sandbox. The runtime is an LLM that reads natural language and acts on it.
推奨ツール
別のキーワードを試すか、フィルタを外してください。
インストール
npx skillfish add aveproject/ave