skills.rest
nguyenpv1980-wq
nguyenpv1980-wqCOMMUNITY
Explore all skills by this author →
GitHub

ai-threat-modeler

Generate design-time AI threat models for LLM features and RAG pipelines.

2|Updated Jul 6, 2026
Search Tags:#owasp#threat modeling#llm#rag#agent#ai security
One-click install
npx skills add https://github.com/nguyenpv1980-wq/Project-Aegis --skill ai-threat-modeler
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ai-threat-modeler
Source: https://github.com/nguyenpv1980-wq/Project-Aegis/tree/main/.claude/skills/ai-threat-modeler
Command: npx skills add https://github.com/nguyenpv1980-wq/Project-Aegis --skill ai-threat-modeler

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill produces a design-time threat model for an AI feature so teams can identify what could go wrong before an LLM, RAG pipeline, or agent reaches production.

Core Features & Use Cases

  • AI-Specific Risk Inventory: Identifies model calls, retrieval paths, tool use, prompts, credentials, and other AI assets that expand the attack surface.
  • Trust Boundary Analysis: Marks every untrusted input source, including tickets, emails, webpages, logs, tool outputs, and prior model outputs.
  • OWASP LLM Top 10 Coverage: Enumerates threats and abuse cases across prompt injection, disclosure, poisoning, output handling, excessive agency, prompt leakage, vector weaknesses, misinformation, and unbounded consumption.
  • Mitigation Mapping: Assigns each accepted risk to an owning skill and a proof case so defenses are actionable and testable.
  • Use Case: A team is adding a support agent that reads customer tickets, searches a knowledge base, and can issue refunds; this Skill helps model the AI risks before the design is built.

Quick Start

Use the ai-threat-modeler skill to assess the AI system’s assets, trust boundaries, OWASP LLM Top 10 threats, abuse cases, and mitigations before implementation.

Frequently Asked Questions about ai-threat-modeler

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is AI threat modeling for LLM applications and when do I need it?▼

AI threat modeling identifies risks in LLM features, RAG pipelines, and agentic workflows before they ship. You need it when your system assembles untrusted inputs, retrieves external content, invokes tools, or relies on model outputs for user-facing or operational actions.

How do I map OWASP LLM Top 10 threats to my RAG pipeline design?▼

Map OWASP LLM Top 10 threats by enumerating abuse cases across prompt injection, data disclosure, poisoning, output handling, excessive agency, and vector weaknesses. Apply exploit-path-gated severity to rank risks and assign mitigation ownership with proof cases for your RAG pipeline.

Can I use this to assess risks for an AI agent that uses external tools?▼

Yes, you can assess agentic workflows that invoke external tools. The threat model identifies tool use as an expanding attack surface and evaluates excessive agency risks by analyzing trust boundaries and untrusted tool outputs before the agent reaches production.

Does this threat modeling approach cover prompt injection and data poisoning abuse cases?▼

Yes, it covers prompt injection and data poisoning abuse cases derived from attacker behaviors. It anchors threats to the OWASP LLM Top 10 and analyzes exploit paths to determine severity, ensuring mitigations are actionable and testable against these specific vulnerabilities.

What's the best way to document trust boundaries for an AI support agent?▼

Document trust boundaries by marking every untrusted input source the agent interacts with, including customer tickets, knowledge base searches, webpages, logs, and prior model outputs. This identifies where untrusted data crosses into your AI system's operational boundaries.

How do I assign mitigation ownership for identified AI security risks?▼

Assign mitigation ownership by mapping each accepted risk to an owning skill and a proof case. This ensures defenses against LLM threats are actionable and testable, holding specific components accountable for mitigating vulnerabilities across the AI pipeline.

Related Skills

Explore More Software Engineering Skills→
lagz0nelagz0ne
12

c3-context-design

Define context boundaries and container responsibilities for system architecture.

Community
Intermediate
dungsnowaxedungsnowaxe

agentic-security-threat-modeling

Identify agentic AI security threats using OWASP ASI categories.

Community
Advanced
AndyAnh174AndyAnh174

backend-security-coder

Guide secure backend coding for APIs, authentication, and input validation.

Community
Advanced
cmaennercmaenner
5

prompt-injection-test

Test LLM applications against prompt injection techniques using the Arcanum PI Taxonomy.

Community
Advanced