Data Exposure
Secrets, personal data, and source code reaching AI tools, and whether anything inspects prompts and responses.
Sensitive data events reaching AI tools
approximate
Two numbers added together:
- guard detections on prompts and tool calls in the last 30 days
- tool calls whose stored content matches the patterns of a guard that is switched on but not enforcing
Target: 0.
Why it matters. A detection is an attempt that a guard caught. A match with no detection is the same attempt, but no guard stopped it. These matches do not appear on your dashboard at all, so a month full of them looks the same as a month with no incidents.
How to improve it.
- Activate and attach any guard that this KPI lists as not enforcing. The evidence shown next to each guard is real traffic that the guard's own patterns already match, so the guard would start catching it immediately.
- Switch the guards that catch the most sensitive content from Warn to Block, or to Redact where the workflow still needs to function.
- Share the most common patterns with your security awareness training, so that employees stop pasting this data into AI tools.
See Guards and Guard check types.
Framework mapping: OWASP LLM LLM02 Sensitive Information Disclosure · NIST GenAI Profile Data Privacy
Published skills never security reviewed
Skills published by your organization that are live in the catalog but that the build-time review has never checked. These skills have no risk score and no approval record. Target: 0.
Why it matters. A published skill runs on every device that syncs it. It is the one set of agent instructions that you control centrally and distribute to everyone at once. Review is turned off by default. Because of that, a skill can go from one person's upload to every synced agent without anyone reading it.
How to improve it.
- Set a risk threshold in Skills Settings > Skill Review Policy, so nothing new publishes without a score behind it.
- For the skills already live, open each skill and save it. Saving re-runs the scan and records a result. Willow holds any skill with a high risk score until you decide what to do with it.
- Withdraw any skill that nobody in your organization can explain. A skill in the catalog that nobody owns is still a set of instructions that you send to every agent.
See Skills settings.
Framework mapping: OWASP LLM LLM08 Vector and Embedding Weakness · OWASP AST10 AST09 No Governance · SANS Access Controls
Active integrations with no guard attached
Percentage of active integrations that have no guard covering their traffic. Target: 0%.
Why it matters. If an integration has no guard, nothing checks its traffic. Nothing checks the data your users send out, and nothing checks the instructions that come back from the tool.
How to improve it.
- First, attach a runtime guard that covers all integrations, so every integration has at least basic protection. Then add stricter guards to the sensitive integrations.
- Cover both directions. Request guards stop your data from leaving. Response guards stop hidden instructions from reaching the model.
Framework mapping: OWASP LLM LLM01 Prompt Injection · SANS Inference Security · Gartner TRiSM Layer 2
Tool responses not scanned
Counts 1 if no active runtime guard checks the responses that come back from tools, and 0 if at least one guard does. Target: 0.
Why it matters. Indirect prompt injection is an attack that hides instructions inside the content a tool returns. That content can be a ticket comment, a web page, or a file. If you only scan the requests your users send, those instructions reach the model unchecked.
How to improve it.
- Add a runtime guard and set its attachment direction to responses, or to both.
- Include a prompt-injection check in that guard, not just data patterns.
See Prompt guard.
Framework mapping: OWASP LLM LLM05 Improper Output Handling · MITRE ATLAS AML.T0054 LLM Prompt Injection
Secrets hardcoded in AI configurations
Partial coverage
Managed MCP proxy configs and discovered device configs matching known secret patterns — cloud keys, tokens, private keys, connection strings. Target: 0.
Why it matters. Every agent that loads the configuration file reads the secret. The secret is also sent to the AI model whenever someone asks an agent to summarize or debug that configuration.
How to improve it.
- Move each secret into Vault and replace it with a
{{vault.NAME}}reference. - Rotate every secret that was found in plaintext.
- Add a build-time guard that rejects configs containing credential patterns.
See Vault.
Framework mapping: OWASP LLM LLM02 Sensitive Information Disclosure · OWASP NHI NHI2 Secret Leakage
Skills that read credentials and can send data out
approximate Partial coverage
Skills whose instructions do two things at once. First, they read a place where credentials are stored, such as SSH keys, .env files, cloud configuration files, or the operating system keychain. Second, they include a way to send data out, such as curl, a webhook, or an HTTP write request. Target: 0.
Why it matters. Each of these two behaviours is normal on its own. Together they give the skill everything it needs to read your credentials and send them to an attacker. The skill still presents itself as a simple formatter or helper.
How to improve it.
- For each skill, read the two instructions that Willow matched. Ask whether the skill's stated purpose really requires it to read that credential file, and whether it really requires it to send that request.
- Block the ones with no justification, and rotate every credential held in a path they name.
- For the skills you keep, remove the direct download. Send the request through a managed integration instead, so that a guard checks the outgoing data and the gateway records it.
Framework mapping: OWASP AST10 AST03 Over-Privileged Skills · OWASP LLM LLM02 Sensitive Information Disclosure · OWASP NHI NHI2 Secret Leakage