Repositorysnyk-workshops/vulnerable-student-assistantDemo
Many generative AI systems attempt to enforce authorization rules solely via prompt instructions. This workshop app provides a hands-on environment for developers and security professionals to see why prompt-level access controls fail against injection attacks.
Published under the Apache-2.0 licence, this repository from Snyk Workshops is a lightweight learning resource with minimal maturity (4 stars, 5 forks). It features instructions to run the FastAPI app directly or generate the codebase using prompts via the Gemini CLI. The application deliberately feeds sensitive mock grade records directly into the LLM's context while relying entirely on soft system instructions to restrict output. This cleanly isolates a fundamental security anti-pattern in LLM engineering for training purposes.
Summary generated by AI (Gemini 3.8 Flash, 12 October 2026). It may contain errors – the original source is authoritative.
Similar in content, found by the AI search.
VideoVideo:CURT
In this workshop, Snyk Developer Advocate Javier Garza breaks down foundational AI security practices. Walking through the OWASP Top 10 for LLMs, he demonstrates direct and indirect prompt injection attacks, sensitive data disclosure, and supply chain risks, while detailing defensive architectures including system prompts, human approvals, database views, and MCP security scans.
Repository:snyk/agent-scan
Agent Scan is an open-source security tool from Snyk that discovers and scans local AI agent components, MCP servers, and skills for prompt injections and vulnerabilities.
3.1kstarsPython
Repository:nealbridges/VulnHunter
VulnHunter is an open-source, agentic AI security scanner that inspects source code from an attacker's perspective, confirms exploitability, and generates fixes. This maintained fork of Capital One's original project decouples the tool from Claude Code to support arbitrary agent harnesses and open-weight models.
223starsPython
Link:Snyk
Snyk has introduced a six-module training curriculum titled AI Security Engineer Foundations. Delivered online and in person, the half-hour sessions address security across agentic workflows, MCP architectures, and AI-assisted development.
Repository:NVIDIA/SkillSpector
SkillSpector is an open-source security scanner from NVIDIA designed to inspect extensions and skills for AI agents (such as Claude Code, Codex CLI, and MCP) for vulnerabilities and malicious patterns before installation.
15.9kstarsPython
Repository:ShenSeanChen/launch-agentic-rag
An open-source repository providing a reference implementation of Agentic RAG using FastAPI. The project extends standard retrieval workflows with autonomous reasoning loops and external tool execution, such as calendar scheduling and email dispatch.
43starsPython
Parts of this content were created with the assistance of AI.
