ai-threat-modeler

What problem does it solve?

This Skill produces a design-time threat model for an AI feature so teams can identify what could go wrong before an LLM, RAG pipeline, or agent reaches production.

Core Features & Use Cases

• AI-Specific Risk Inventory: Identifies model calls, retrieval paths, tool use, prompts, credentials, and other AI assets that expand the attack surface.
• Trust Boundary Analysis: Marks every untrusted input source, including tickets, emails, webpages, logs, tool outputs, and prior model outputs.
• OWASP LLM Top 10 Coverage: Enumerates threats and abuse cases across prompt injection, disclosure, poisoning, output handling, excessive agency, prompt leakage, vector weaknesses, misinformation, and unbounded consumption.
• Mitigation Mapping: Assigns each accepted risk to an owning skill and a proof case so defenses are actionable and testable.
• Use Case: A team is adding a support agent that reads customer tickets, searches a knowledge base, and can issue refunds; this Skill helps model the AI risks before the design is built.

Quick Start

Use the ai-threat-modeler skill to assess the AI system’s assets, trust boundaries, OWASP LLM Top 10 threats, abuse cases, and mitigations before implementation.