ai-security

# AI Security Acknowledgement: Shared by Peter Bamuhigire, techguypeter.com, +256 784 464178. <!-- dual-compat-start --> ## Use When - Security checklist for AI-powered application features — prompt injection defense, PII scrubbing before API calls, output validation, rate limiting, audit logging, adversarial inputs, and DPPA/GDPR compliance for AI data flows. Invoke during... ## Do Not Use When - The request is a general application-security review with no model, retrieval, prompt, or agent boundary; route it to the security skills. - The task is model-quality evaluation without an abuse, privacy, authorization, or data-isolation question; use `ai-evaluation`. ## Required Inputs | Input | Required | Why it matters | |---|---|---| | AI data-flow and trust boundaries | yes | Locates untrusted content, model calls, tools, stores, and tenant crossings | | Data classification and retention rules | yes | Determines what may leave the application and what may be logged | | Model, retrieval, and tool interfaces | yes | Exposes injection paths and privileged side effects | | Existing auth, rate-limit, and audit controls | conditional | Prevents the AI layer from bypassing platform controls | ## Workflow Map the AI data flow, classify each boundary, enumerate abuse cases, select preventive and detective controls, then verify tenant isolation, output handling, logging, and failure behavior with adversarial tests. ## Quality Standards Findings name the affected boundary, attac...