design-ai-redteam-planlisted

# Skill: design-ai-redteam-plan > **Invoked by:** `ai-redteam-lead` (primary). Also consulted by `adversarial-testing-engineer` when execution reveals the scope or threat model is wrong. > > **When to invoke:** "How should we red-team <AI system>?"; "what should we attack first?"; "safety or security problem?"; "what are the rules of engagement / disclosure?"; any move from a deployed AI system to a scoped adversarial plan. > > **Output:** the threat model + safety-vs-security split + the prioritized attack taxonomy (OWASP LLM Top 10 / MITRE ATLAS) + rules of engagement + likelihood×impact success/severity criteria, captured in the red-team plan. ## Procedure 1. **Characterize the system under test.** Model(s) and version; **what it reads** (user turns only, or web/docs/RAG/tool results — attacker-controllable?); **what it can do** (text only, or tools/code/email/payments/browsing); **what it knows/reaches** (system prompt, user PII, training corpus, other tenants); modalities; and its **trust boundaries** (where untrusted input crosses into a privileged context). A plan with no system characterization is guessing. 2. **Threat-model: assets × attackers × abuse cases.** Name the **assets** (system prompt, RAG data, downstream actions, user data), the **attackers** (external user, a poisoned document, a compromised dependency), and the **abuse cases** (what unauthorized outcome each attacker wants). This is the source the taxonomy is derived from — not a blog's jailbreak lis