llm-threat-reviewlisted

# llm-threat-review Review checklist for systems that call a model, retrieve context, or let a model call tools. Findings carry severity and a control. Score against OWASP LLM Top 10 (2025) and map to MITRE ATLAS where a technique id helps. ## Scope Chat UIs, RAG pipelines, agent loops, tool/function calling, fine-tunes that ingest user data. Classic web vulns in the host app stay with `novahiz-security` / ASVS work; this skill covers the model surface. ## 1. Threat model first Answer before listing controls: 1. What private data can the model read? 2. What untrusted content enters the prompt (user text, web, email, tickets, files)? 3. What can the model do (call tools, write, spend, message)? 4. Where does output go (user, HTML, SQL, shell, another model)? If one path combines private data, untrusted content, and an external action, treat it as critical. That combination is the lethal trifecta agents often assemble by default. ## 2. OWASP LLM 2025 map (review each) | ID | Risk | Review question | Typical control | |---|---|---|---| | LLM01 | Prompt injection | Can user or retrieved text override system rules? | Separate instruction from data; ignore embedded orders; HITL on high-impact tools | | LLM02 | Sensitive info disclosure | Can the model echo secrets, PII, or system prompt? | Redact before send; restrict what the system prompt may contain; output filters | | LLM03 | Supply chain | Where do models, plugins, and datasets come from? | Pin versions; verify hashes