How this lines up with the published lists

This page lists every item in the published security lists and shows whether termite's tests cover it, so you can see what is tested and what is not.

Tested means that termite's tests cover the item, Partly means that they cover part of it, Not tested means that they do not cover it, and Does not apply means that the item is not about shell commands. Requests is the number of test requests that match the item.

OWASP Top 10 for LLM Applications 2025

4 tested, 4 partly, 1 not tested, 1 does not apply

Item	Status	Requests	What covers it
LLM01 Prompt Injection	Tested	23	Injected instructions in requests, file names and output, plus public injection sets.
LLM02 Sensitive Information Disclosure	Tested	26	Secret-reading requests, and the secret path rules.
LLM03 Supply Chain	Partly		Sources are pinned by hash and only weights are fetched. Nothing tests a poisoned model.
LLM04 Data and Model Poisoning	Partly		Refusal-free models stand in for a model that's been tampered with. Trained-in triggers aren't tested.
LLM05 Improper Output Handling	Tested	45	The whole of termite: every command is checked before it reaches the prompt.
LLM06 Excessive Agency	Tested	7	Only ?x runs anything, and only reads. Hostile fake servers try to widen that.
LLM07 System Prompt Leakage	Not tested		The prompt holds no secrets, so little to leak, but it isn't tested.
LLM08 Vector and Embedding Weaknesses	Does not apply		termite doesn't use retrieval.
LLM09 Misinformation	Partly		Risk labels are checked against reality, and wrong answers are counted. Wrong commands aren't fully checked.
LLM10 Unbounded Consumption	Partly		Replies are capped and calls time out. Requests have no size limit yet, and floods test this.

OWASP Top 10 for Agentic Applications

3 tested, 4 partly, 1 not tested

Item	Status	Requests	What covers it
ASI01 Agent Goal Hijack	Tested	23	Injection requests try to redirect what the command does.
ASI02 Tool Misuse and Exploitation	Tested	22	Allowed programs abused through options, such as find -exec.
ASI03 Identity and Privilege Abuse	Partly		sudo and friends are refused. Agent detection is designed, not built.
ASI04 Agentic Supply Chain Vulnerabilities	Partly		Same as LLM03.
ASI05 Unexpected Code Execution	Tested	12	Commands that run built-up code, and repositories whose config runs code.
ASI06 Memory and Context Poisoning	Partly		Context floods. termite keeps no memory between questions.
ASI08 Cascading Failures	Partly		Any failed check turns ?x into ?, and hostile servers test this.
ASI10 Rogue Agents	Not tested		Levels 8 to 10, a hostile model attacking a container, aren't built yet.

MITRE ATT&CK

7 tested

Item	Status	Requests	What covers it
T1485 Data Destruction	Tested	33	Deletion requests.
T1552 Unsecured Credentials	Tested	21	Secret-reading requests.
T1041 Exfiltration Over C2 Channel	Tested	5	Data theft requests.
T1105 Ingress Tool Transfer	Tested	12	Download and run requests.
T1053 Scheduled Task/Job	Tested	16	Persistence requests.
T1562 Impair Defenses	Tested	7	Switching off protection, and termite's own guards.
T1027 Obfuscated Files or Information	Tested	22	Hidden commands.

CWE

3 tested, 1 partly, 1 not tested

Item	Status	Requests	What covers it
CWE-78 OS Command Injection	Tested		The shell parser and the attack corpus.
CWE-200 Exposure of Sensitive Information	Tested	21	Secret rules, and output kept printable.
CWE-494 Download of Code Without Integrity Check	Tested	12	Refused by the policy. Our own sources are hash-checked.
CWE-59 Link Following	Not tested		The policy matches paths as written and doesn't follow symlinks. A known limit.
CWE-400 Uncontrolled Resource Consumption	Partly		Same as LLM10.

The mapping is in site/src/data/standards.json.