aibot88 Agent Security — audit skill
Generic skill shipped with the training. Walks two lenses against any agent system pointed at it:
- Access-control analysis — what external systems the agent can reach, and whether each reach is necessary.
- Agent-STRIDE — the six STRIDE categories adapted to agent systems (not classical software systems).
Invocation
Ask Claude to "apply the agent-security skill to [target system]."
Output lands at module-4/security-report.md.
Access-control pass
For each external touch-point the target system has, answer:
- What does the agent reach? (connector, file write beyond working dir, sub-agent dispatch, tool use)
- Why does it reach? (what the system actually does with it)
- Could the system work without it? (if yes → unused access, flag)
List unused access as a cluster of access-control findings. Each gets a severity rating (high / medium / low) based on what the access could enable if the agent misbehaves.
Agent-STRIDE
Six categories, each adapted. See stride.md for full definitions.
Short form:
- Spoofing — an agent impersonates a human author; a memory file pretends to be from a source that doesn't exist.
- Tampering — an agent modifies memory / rules / sources in ways that sneak into future sessions; output drift through silent edits.
- Repudiation — the agent writes without attribution; no audit of which agent produced what at what time.
- Information disclosure — the agent reveals content it was told to hold (personal notes, Confidential data, restricted sources).
- Denial of service — agent loops, subagent sprawl, runaway memory growth that locks out the human operator.
- Elevation of privilege — an agent invokes another agent that has wider scope than the first should carry; transitive trust violations.
For each category, name the top 1-2 specific risks in the target system — not generic category descriptions.
Mitigations (five shapes)
Each risk gets one suggested mitigation:
- Scope — narrow what the agent reads / writes / invokes.
- Split — separate the agent into two with distinct permission profiles.
- Filter — add a rule the agent must apply before writing (e.g., "redact PII before saving").
- Gate — add a human-approval step (e.g., "show me the diff before applying").
- Review — add a second agent that checks the first's output.
Match mitigation shape to risk shape. Not all shapes fit all risks.
Output shape
module-4/security-report.md:
## Access-control findings
<list, ranked by severity>
## Agent-STRIDE findings
<six sub-sections, each with 1-2 named risks>
## Ranked mitigations
<three-tier: high / medium / low, each with one mitigation shape>
See access-analysis.md and stride.md for the full walk.
See mitigations.md for worked examples of each shape.