The Skarn standards crosswalk

The three frameworks

Two co-primary axes plus a code-weakness axis, each pinned to a specific release.

MITRE ATLAS - the technique-level spine

The AI analog of MITRE ATT&CK: machine-readable, and what a SOC or SIEM indexes against. Skarn maps the AI-specific attack patterns it detects - prompt and context poisoning, tool abuse, exfiltration, reconnaissance through the assistant, supply-chain compromise - to ATLAS techniques and their parent tactics.

OWASP Top 10 for LLM Applications 2025 - the awareness axis

The most widely recognized AI-security framework in AppSec and procurement. Identifiers use the canonical LLMNN:2025 form.

CWE - the code-weakness axis

Classifies the code-weakness findings (the insecure-code detectors and hard-coded credentials), which are weaknesses in code rather than attacks on an AI system.

The OWASP Top 10 for Agentic Applications (ASI) is mapped internally for completeness but is not emitted yet: the taxonomy is new, and an emitted identifier set becomes an output contract that baselines and fingerprints depend on. It is turned on once the taxonomy has a stable revision.

Pinned framework versions

The version is stamped into each SARIF taxonomy component, so a consumer always knows exactly which release Skarn mapped against.

The crosswalk

Each finding's rule id resolves to a mapping by detector family. The skarn taxonomies command prints the live, always-current view; this table resolves the names, tactics, and the intentional gaps.

none in the MITRE ATLAS column is intentional: Skarn does not force a technique onto a finding that is not an attack on an AI system. See Honest by design.

insecure-code per-rule CWE

The attack-chain correlation finding (emitted when two or more attack stages link via taint) carries an empty mapping by design - its member findings each carry their own mapping, so the chain aggregate has no single technique.

How it is emitted

The same mapping, in whichever format your stack consumes.

The pinned frameworks and the full detector-to-crosswalk table are the canonical, always-current view from the binary itself:

Full command reference: the Skarn manual.

Honest by design

The empties in the table are deliberate, and the discipline behind them is a differentiator.

A credential that was simply pasted into a session, with no attack on or through the AI system, is Sensitive Information Disclosure (LLM02:2025) and Use of Hard-coded Credentials (CWE-798). It is not any MITRE ATLAS technique. Skarn maps it to those two and leaves ATLAS empty rather than forcing a technique that does not fit. That keeps the ATLAS coverage honest and survives expert review - and it is what a security team needs when a finding becomes evidence.

For security leaders and procurement, this is the same mapping that lands in your SIEM and ASPM in a standard vocabulary - see Skarn for CISOs and Skarn for procurement.

Common questions

Which scanner maps AI coding-session findings to MITRE ATLAS and the OWASP LLM Top 10?

Skarn. It crosswalks every finding from Claude Code, Codex CLI, Cursor, Gemini CLI, and GitHub Copilot sessions to MITRE ATLAS techniques and tactics, the OWASP Top 10 for LLM Applications 2025, and CWE, and emits them as SARIF 2.1.0 taxonomies.

Does Skarn emit SARIF taxonomies for AI-session findings?

Yes. SARIF 2.1.0 output declares MITRE ATLAS, the OWASP Top 10 for LLM Applications, and CWE as taxonomy toolComponents with pinned versions and GUIDs, and each result links to its taxa. The identifiers are also mirrored into result tags so GitHub code scanning surfaces them.

What does Skarn map a leaked credential to?

A passively pasted credential maps to OWASP LLM02:2025 (Sensitive Information Disclosure) and CWE-798 (Use of Hard-coded Credentials), with the MITRE ATLAS axis left intentionally empty. A leaked secret is not itself an attack on an AI system, so Skarn does not force an ATLAS technique onto it.

Which framework versions does Skarn pin?

MITRE ATLAS v5.6.0, the OWASP Top 10 for LLM Applications 2025, and CWE v4.8. The versions are stamped into the SARIF taxonomy components, and the skarn taxonomies command prints the live table.