threat-modeling-agentic-tools

name	threat-modeling-agentic-tools
description	Threat-model agentic tooling — MCP/tool abuse, hook/prompt injection, remote control surfaces, and secret leakage. Use during security reviews or when adding features that expose the system to AI agents or remote callers.

Threat modeling (agentic tools)

Use this skill when

• Security reviews, or new features touching MCP servers, tools, hooks, or any remote-control surface
• Writing or updating security docs
• Running /security-review or reviewing compact MCP dispatch actions

Procedure

1. Read .agent/SAFETY.md and backend docs/technical/MCP_SEARCH_DISPATCH.md.
2. Enumerate assets: secrets/tokens, credentials, workspace files, agent sessions, PostgreSQL data, Electron IPC surfaces, any data the tools can read or mutate.
3. Enumerate threats (adapt to your surfaces):
   • Compromised caller / session hijack → access bypass? (mitigate: pairing/allowlist, auth, rate limits)
   • Local network or co-tenant attacker → exposed RPC/endpoint? (mitigate: localhost bind, bearer token)
   • Malicious tool caller → arbitrary operations? (mitigate: tool allowlist, confirmed=True gate, no raw shell tools)
   • Hook / prompt / payload injection → RCE or unintended action? (mitigate: validate input, no eval, minimal hook scripts)
   • Log / output exfiltration → secrets in logs or tool output? (mitigate: redaction, never return secrets)
   • Callback / request replay → duplicate side effects? (mitigate: nonce, expiry, idempotency)
4. Document fail-closed behavior for each path (deny on doubt).
5. List known limitations explicitly.

Safety checks

• Every new external input has a validation schema and an abuse note.
• Explicit approval required for high-risk / side-effecting action types.
• Renderer must not access DB or filesystem directly — IPC/preload only.

Done criteria

• Review output lists threats, mitigations, gaps, and recommended tests.
• No undocumented secret-storage locations; secrets never appear in logs or tool output.