Scanners-Box 每日 AI 工具推荐 Scanners-Box Daily AI Tool Picks
AI 安全验证标准与规范 AI Security Verification Standards
共 1 个工具 · 专栏不定期更新 1 tools · new issues as they're written
可测试的标准与清单：把 AI 安全要求写成有编号、有等级、可引用的验收条目，上线评审和供应商评估直接拿来对照。Testable standards and checklists that define verifiable AI security — numbered, levelled and citable requirements to review against.
不是又一份 AI 风险 Top 10：它把训练数据、RAG 记忆、Agent 与 MCP 拆成 213 条可验证要求，告诉团队具体该做什么、做完怎么验 Not another AI-risk Top 10: 213 testable requirements across training data, RAG memory, agents and MCP — turning security principles into reviewable, testable engineering objects
1.01 已锁定，1.02 开发中；12 章 213 条核心要求，L1/L2/L3 为 57/110/46。重点是跨章节联防：C2 输入检测 + C10 MCP 输出筛查 + C9 确定性授权；Agent 审批从展示完整参数走到密码学绑定动作对象；RAG 记忆要有租户边界、写入检疫、过期与审计。短板：没有官方扫描器，幻觉/投毒等判定器本身仍不可靠，部分条款需按输入类型裁剪；不替代 ASVS、NIST AI RMF 或威胁建模。
Stable 1.01 is locked while 1.02 is in development: 213 core requirements across 12 chapters, with L1/L2/L3 at 57/110/46. Its strength is cross-chapter defense: C2 input screening + C10 MCP response validation + C9 deterministic authorization. Agent approval progresses from complete parameter display to cryptographic binding with the action object; RAG memory gets tenant boundaries, write quarantine, expiry and audit. Caveats: no official scanner, imperfect oracles for hallucination and poisoning, and some requirements need careful scoping. It does not replace ASVS, NIST AI RMF or threat modeling.
https://github.com/OWASP/AISVS
其他分类Other categories
AI-Generated Code Security EvaluationAI-Generated Code Security Evaluation AI 基础设施攻击面发现AI Infrastructure Attack Surface Discovery AI 红队测试框架与 AgentAI Red Teaming Frameworks & Agents AI 智能体运行时管控AI Agent Runtime Controls Agent 工作流安全工具箱Security Toolkits for Agentic Workflows AI 智能体与应用安全审计Security Auditing for AI Agents & Apps Agent 技能：漏洞发现与修复Agent Skills for Vulnerability Discovery & Remediation Agent Skills 安全审计Security Auditing for Agent Skills LLM 驱动的漏洞扫描器LLM-Powered Vulnerability Scanners