AgentSafeLabs / safelabs-eval

# safelabs-eval
**Open-source red-teaming and evaluation framework for AI agents — built around an OWASP-inspired agent-security taxonomy.**
---
AI agents built on LangChain, CrewAI, AutoGen, LlamaIndex, the OpenAI Agents SDK, Google ADK, Semantic Kernel, and custom frameworks can reach production without systematic adversarial safety testing. `safelabs-eval` changes that.
Point it at a supported HTTP agent endpoint — or wrap a Python callable — and it fires **300 curated adversarial prompts** (30 per category) across all 10 ASI categories, scores every response with pattern-based detectors, and produces a structured security report. The ASI01–ASI10 category structure is OWASP-inspired, not the official OWASP Top 10 for Agentic Applications 2026 — see the taxonomy note.
No LLM calls required for detection. No agent code modifications required. No SafeLabs-specific infrastructure required.
---
## Install
 [code] 
**Requirements:** Python 3.11+
---
## Quick Start
### Option 1 — CLI: test a supported HTTP agent endpoint
 [code] 
**Example report — Claude Haiku vs. ASI01 Prompt Injection (abbreviated to the first 3 prompts; captured at v0.2.2, when ASI01 had 14 prompts — it now has 30):**
 [code] 
---
### Option 2 — Python API: wrap any callable
 [code] 
Both `def` and `async def` callables are accepted. No agent code modification required.
**Run all 10 ASI categories (300 prompts total):**
 [code] 
**Access individual results:**
 [code] 
> **Reading the confidence figure.** The `confidence` value (shown as "conf" in
> the CLI report) is a heuristic evidence score produced by the pattern-based
> detectors — roughly, how much matched evidence supports the verdict. It is
> not a statistically calibrated probability, and should not be read as "the
> chance this verdict is correct."
---
### Browse the prompt library
 [code] 
---
## ASI Category Coverage
> **Taxonomy note.** safelabs-eval's prompt taxonomy (ASI01–ASI10) is an
> OWASP-inspired agent-security category structure that uses an independently
> structured category set. It differs from OWASP's
> official Top 10 for Agentic Applications 2026
> (published Dec 9, 2025), which uses a different category structure (Agent
> Goal Hijack, Tool Misuse & Exploitation, Identity & Privilege Abuse, etc.).
> This corpus is not currently mapped to that newer official taxonomy. Note
> that the official list also numbers its categories `ASI01`–`ASI10`, so an
> ID such as `ASI01` here does **not** refer to the same category as OWASP's
> `ASI01` (Agent Goal Hijack).
| Category | Name | Prompts | Detector |
|---|---|---|---|
| **ASI01** | Prompt Injection | 30 | `PromptInjectionDetector` |
| **ASI02** | Insecure Output Handling | 30 | pattern suite |
| **ASI03** | Excessive Agency | 30 | `ScopeViolationDetector` |
| **ASI04** | Resource Management | 30 | pattern suite |
| **ASI05** | Tool Use Safety | 30 | pattern suite |
| **ASI06** | Data Privacy & Confidentiality | 30 | `DataLeakageDetector` |
| **ASI07** | Trust