Agentic System Security Review
Review the security of a complete model-mediated system while keeping specialized scopes clear. application-security-review evaluates conventional application controls. skill-security-review evaluates a skill or plugin package. This workflow evaluates the interactions among agents, models, instructions, identity, tools, memory, retrieval, delegation, protocols, and outputs.
Preconditions
Identify the system owner, users, tenants, agent and service identities, models, registered tools, data classifications, trust zones, deployment proposal, and decision under review. Obtain current architecture, code, configuration, and observed test evidence. Treat missing evidence as a gap.
Workflow
- Map trust boundaries, principals, credentials, agent hierarchy, models, instructions, tools, toolsets, context, session state, memory, retrieval, external protocols, output consumers, and control-plane owners.
- Build abuse cases for direct and indirect prompt injection, instruction conflict, excessive agency, privilege abuse, unsafe delegation, and confused-deputy behavior.
- Review tool misuse, argument manipulation, object ownership, SSRF, network reach, data exfiltration, unsafe external writes, confirmation replay, duplicate side effects, cancellation, idempotency, and emergency stopping.
- Review skill, model, prompt, dependency, plugin, retrieval, and build supply chains. Pin exact versions and define change review and revocation.
- Review memory and context poisoning, retrieval poisoning, stale authority, provenance loss, and cross-user and cross-tenant leakage.
- Review identity propagation, delegated authority, least privilege, credential isolation, audit records, approval boundaries, and separation of proposal from ratified action.
- Review model and framework drift, cost and resource exhaustion, denial of wallet, rate limits, budgets, timeouts, and bounded retries.
- Review unsafe output rendering, active content, formula or command injection, sensitive output, and downstream consumers that might execute model output.
- Verify deterministic host controls. Skill content cannot grant a tool, credential, permission, approval, deployment, publication, or release state.
- Define adversarial tests, monitoring, incident response, revocation, and a fail-closed stopping path. Do not implement controls unless separately requested.
Result Rules
APPROVE requires no unresolved blocker for the named scope and current evidence.APPROVE WITH CONDITIONS lists the conditions, owners, and evidence required before the affected use.REJECT identifies an active blocker or boundary that cannot safely support the proposal.- Do not claim certification, complete compliance, production readiness, or protection from every prompt attack.
Output
Return Decision, Scope and exact versions, Trust and identity map, Threat scenarios, Tool and action controls, Context memory and retrieval, Delegation and protocols, Supply chain, Output safety, Resource controls, Monitoring and response, Findings by severity, Required tests, Conditions, and Limitations.
1---2name: agentic-system-security-review3description: Review an agentic system across agent identity, models, instructions, tools, memory, retrieval, delegation, protocols, guardrails, outputs, supply chain, cost, revocation, and emergency stopping. Use for a read-only threat and control assessment of model-mediated actions; use application-security-review for conventional application controls and skill-security-review for a skill package.4license: MIT5---67# Agentic System Security Review89Review the security of a complete model-mediated system while keeping specialized scopes clear. `application-security-review` evaluates conventional application controls. `skill-security-review` evaluates a skill or plugin package. This workflow evaluates the interactions among agents, models, instructions, identity, tools, memory, retrieval, delegation, protocols, and outputs.1011## Preconditions1213Identify the system owner, users, tenants, agent and service identities, models, registered tools, data classifications, trust zones, deployment proposal, and decision under review. Obtain current architecture, code, configuration, and observed test evidence. Treat missing evidence as a gap.1415## Workflow16171. Map trust boundaries, principals, credentials, agent hierarchy, models, instructions, tools, toolsets, context, session state, memory, retrieval, external protocols, output consumers, and control-plane owners.182. Build abuse cases for direct and indirect prompt injection, instruction conflict, excessive agency, privilege abuse, unsafe delegation, and confused-deputy behavior.193. Review tool misuse, argument manipulation, object ownership, SSRF, network reach, data exfiltration, unsafe external writes, confirmation replay, duplicate side effects, cancellation, idempotency, and emergency stopping.204. Review skill, model, prompt, dependency, plugin, retrieval, and build supply chains. Pin exact versions and define change review and revocation.215. Review memory and context poisoning, retrieval poisoning, stale authority, provenance loss, and cross-user and cross-tenant leakage.226. Review identity propagation, delegated authority, least privilege, credential isolation, audit records, approval boundaries, and separation of proposal from ratified action.237. Review model and framework drift, cost and resource exhaustion, denial of wallet, rate limits, budgets, timeouts, and bounded retries.248. Review unsafe output rendering, active content, formula or command injection, sensitive output, and downstream consumers that might execute model output.259. Verify deterministic host controls. Skill content cannot grant a tool, credential, permission, approval, deployment, publication, or release state.2610. Define adversarial tests, monitoring, incident response, revocation, and a fail-closed stopping path. Do not implement controls unless separately requested.2728## Result Rules2930- `APPROVE` requires no unresolved blocker for the named scope and current evidence.31- `APPROVE WITH CONDITIONS` lists the conditions, owners, and evidence required before the affected use.32- `REJECT` identifies an active blocker or boundary that cannot safely support the proposal.33- Do not claim certification, complete compliance, production readiness, or protection from every prompt attack.3435## Output3637Return `Decision`, `Scope and exact versions`, `Trust and identity map`, `Threat scenarios`, `Tool and action controls`, `Context memory and retrieval`, `Delegation and protocols`, `Supply chain`, `Output safety`, `Resource controls`, `Monitoring and response`, `Findings by severity`, `Required tests`, `Conditions`, and `Limitations`.
JovaniPink