ai-application-security

name	ai-application-security
description	Use when auditing, building, testing, or releasing AI applications, LLM apps, RAG systems, vector databases, embedding pipelines, prompt templates, system prompts, tool-using agents, model routing, AI data leakage, prompt injection, jailbreak resistance, retrieval poisoning, system prompt leakage, or AI security guardrails.
activation	Activate when the description trigger applies to the current task.
required_inputs	Task request, relevant repository context, constraints, and authority dependencies.
required_outputs	Skill-specific artifact, verification evidence, canonical verdict, and next action.
authority_dependencies	00_start_here/SOURCE_OF_TRUTH.md; 10_governance/APIVR_EXECUTION_LIFECYCLE.md; 10_governance/source_of_truth/Elite_Build_Goals_v3.md.
evidence_requirements	Executed checks or an honest Unknown, Not Run, or Blocked state for every material claim.

AI Application Security

Use this skill for AI-specific security risks. Route through skills/cybersecurity-risk-routing/SKILL.md first when scope or authorization is uncertain.

Do not test prompt injection, system prompt extraction, RAG poisoning, vector leakage, or model/tool exfiltration against live systems unless the target is owned or explicitly authorized. Never treat a system prompt as a secret or an authorization boundary.

Required Files

• 40_knowledge/SECURITY_FRAMEWORK_MAPPING.md
• 60_templates/SECURITY_EVIDENCE_LEDGER_TEMPLATE.md for Standard and above
• 60_templates/SECURITY_AUTHORIZATION_AND_SCOPE_TEMPLATE.md when testing live endpoints or user/third-party data

APIVR Routing

• Phase 1 Audit: map model, prompts, tools, data sources, vector stores, tenants, retrieval filters, output channels, and secrets.
• Phase 2 Plan: define allowed tests, safe corpus, non-production targets, leak criteria, evidence, and rollback/containment.
• Phase 3 Implement: test or build controls with least privilege, safe fixtures, and redacted logs.
• Phase 4 Audit Implementation: check prompt/data boundaries, tool boundaries, tenant isolation, and logging.
• Phase 5 Verify Implementation: run safe regression probes or document Not Run / Blocked.
• Phase 6 Re-Audit: update residual risk, guardrail gaps, and release verdict.

AI Security Checklist

Area	Check
Prompt boundary	No secrets, credentials, auth logic, or hidden business rules live only in prompts.
Prompt injection	Direct and indirect instruction override is tested or explicitly marked Not Run.
RAG	Retrieved content is treated as untrusted input and separated from system/developer authority.
Vector stores	Tenant isolation, metadata filters, write paths, and retrieval poisoning risks are reviewed.
Tools	Tool calls use allowlists, schemas, least privilege, and approval gates for high-impact actions.
Data leakage	Logs, traces, model outputs, and retrieved chunks avoid secrets and private data exposure.
Evaluation	Regression probes exist for material prompt, retrieval, or tool-routing changes.

Decision Flow

Put API keys, admin routing rules, or customer permissions in the system prompt and rely on the model not revealing them. Keep secrets and authorization server-side, treat prompts as steerable text, test leakage attempts, and enforce tool permissions outside the model.