Security architecture skill

CLAUDE.md

@@ -91,7 +91,7 @@ agent-security-playbook/
 │   │   │   ├── api-security-reviewer.md
 │   │   │   ├── mobile-security-reviewer.md
 │   │   │   └── security-team-lead.md
-│   │   ├── skills/               # 11 code security skills
+│   │   ├── skills/               # 12 code security skills
 │   │   │   ├── securability-engineering/
 │   │   │   ├── securability-engineering-review/
 │   │   │   ├── prd-securability-enhancement/
@@ -102,10 +102,11 @@ agent-security-playbook/
 │   │   │   ├── web-security-review/
 │   │   │   ├── mobile-code-review/
 │   │   │   ├── iac-security-review/
+│   │   │   ├── security-architecture/
 │   │   │   └── security-guidance/
 │   │   ├── plays/                # Step-by-step runbooks for the skills above
-│   │   ├── templates/            # finding.md, report.md (used by skills' output)
-│   │   └── data/                 # FIASSE, ASVS, MASVS, MASTG, and secure-code prompt reference data
+│   │   ├── templates/            # finding.md, report.md, SECURITY_ARCHITECTURE.md (used by skills' output)
+│   │   └── data/                 # FIASSE, ASVS, AISVS, MASVS, MASTG, and secure-code prompt reference data
 │   └── ai-security-skills/       # AI/agent security skills plugin (self-contained)
 │       ├── .claude-plugin/
 │       │   └── plugin.json
@@ -140,7 +141,7 @@ agent-security-playbook/
 |------|-------|--------|
 | **Tier 4** | AI/Agent Security — prompt injection, excessive agency, MCP risks | Built |
 | **Tier 1** | Code Analysis — securability review, SCA, code review, secrets, API security | Built |
-| **Tier 2** | Design Review — threat modeling, ASVS verification, infra hardening | Planned |
+| **Tier 2** | Design Review — security architecture description, threat modeling, ASVS verification, infra hardening | In progress (security-architecture built) |
 | **Tier 3** | Testing — WSTG checklist, DAST scanning, attack surface mapping | Planned |
 | **Tier 5** | Governance — SAMM maturity, compliance mapping, reporting | Planned |
 
@@ -156,6 +157,6 @@ Datasets that ship inside a plugin (bundled with the marketplace install) live u
 | FIASSE v1.0.4 | `OWASP/FIASSE` — `docs/securable_framework.md` (tag `v1.0.4`) | Markdown + YAML frontmatter | securability-engineering, securability-engineering-review, prd-securability-enhancement (61 section files) | `plugins/code-security-skills/data/fiasse/` |
 | Secure-code prompts | (this repo) | Markdown | iac-security-review (terraform, kubernetes, cloudformation) | `plugins/code-security-skills/data/secure-code-prompts/` |
 | LLM Top 10 v2.0 | `OWASP/www-project-top-10-for-large-language-model-applications` | Markdown | (research; not yet bundled) | `data/llm-top10/` |
-| AISVS | `OWASP/aisvs` | Markdown | (research; not yet bundled) | `data/aisvs/` |
+| AISVS | `OWASP/aisvs` | Markdown | security-architecture (AI/agent section cross-reference, C1–C13) | `plugins/code-security-skills/data/aisvs/` (root copy at `data/aisvs/` kept for research) |
 | OpenCRE | [opencre.org](https://www.opencre.org) — REST API | JSON | All skills (cross-standard linking, queried at runtime) | `data/opencre/` |
 | CWE | [cwe.mitre.org](https://cwe.mitre.org) v4.19 | XML, JSON | All skills (weakness classification, queried at runtime) | external |

plugins/code-security-skills/data/aisvs/C1.1.md

@@ -0,0 +1,35 @@
+---
+title: "C1.1 Training Data Provenance"
+aisvs_chapter: "C1.1"
+when_to_use:
+  - building or auditing an inventory of training data sources
+  - onboarding or accepting third-party or external datasets for model training
+  - implementing change control or approval workflows for datasets
+  - assessing compliance with data governance or AI regulations (e.g., EU AI Act)
+  - reviewing training data pipelines for integrity risks
+  - evaluating fine-tuning processes that use external data
+  - assessing RAG knowledge bases for poisoning vectors
+  - auditing model integrity and backdoor risks
+threats:
+  - untrusted or poisoned training data from unvetted sources
+  - lack of auditability for dataset changes
+  - PII or sensitive data leakage via unnecessary features or metadata
+  - test data leakage into training data
+  - training data manipulation introducing backdoors or biases
+  - split-view and frontrunning data poisoning
+  - sleeper agent models with dormant triggers
+  - RAG knowledge base poisoning
+  - malicious model serialization
+summary: "Requirements for maintaining a verifiable inventory of training data, trusted sources, and logged changes for auditability."
+---
+
+# C1.1 Training Data Provenance
+
+Maintain a verifiable inventory of all datasets, accept only trusted sources, and log every change for auditability.
+
+| # | Description | Level | Role |
+| :---: | :--- | :---: | :---: |
+| **1.1.1** | **Verify that** an up-to-date inventory of every training-data source (origin, responsible party, license, collection method, intended use constraints, and processing history) is maintained. | 1 | D/V |
+| **1.1.2** | **Verify that** training data processes exclude unnecessary features, attributes, or fields (e.g., unused metadata, sensitive PII, leaked test data). | 1 | D/V |
+| **1.1.3** | **Verify that** all dataset changes are subject to a logged approval workflow. | 1 | D/V |
+| **1.1.4** | **Verify that** datasets or subsets are watermarked or fingerprinted where feasible. | 3 | D/V |

plugins/code-security-skills/data/aisvs/C1.2.md

@@ -0,0 +1,38 @@
+---
+title: "C1.2 Training Data Security & Integrity"
+aisvs_chapter: "C1.2"
+when_to_use:
+  - designing or reviewing access controls for training data storage and pipelines
+  - implementing encryption for training data at rest and in transit
+  - establishing integrity checks (hashes, signatures) for datasets
+  - defining retention and secure purge procedures for obsolete training data
+  - reviewing training data pipelines for integrity risks
+  - evaluating fine-tuning processes that use external data
+  - assessing RAG knowledge bases for poisoning vectors
+  - auditing model integrity and backdoor risks
+threats:
+  - unauthorized access to or exfiltration of training data
+  - data tampering or poisoning via unauthorized modifications
+  - theft of proprietary or sensitive training data
+  - corruption of training data in storage or transfer
+  - training data manipulation introducing backdoors or biases
+  - split-view and frontrunning data poisoning
+  - sleeper agent models with dormant triggers
+  - RAG knowledge base poisoning
+  - malicious model serialization
+summary: "Requirements for restricting access, encrypting data, and validating integrity to prevent tampering, theft, or data poisoning."
+---
+
+# C1.2 Training Data Security & Integrity
+
+Restrict access to training data, encrypt it at rest and in transit, and validate its integrity to prevent tampering, theft, or data poisoning.
+
+| # | Description | Level | Role |
+| :---: | :--- | :---: | :---: |
+| **1.2.1** | **Verify that** access controls protect training data storage and pipelines. | 1 | D/V |
+| **1.2.2** | **Verify that** all access to training data is logged, including user, time, and action. | 1 | D/V |
+| **1.2.3** | **Verify that** training datasets are encrypted in transit and at rest, using current recommended cryptographic algorithms and key management practices. | 1 | D/V |
+| **1.2.4** | **Verify that** cryptographic hashes or digital signatures are used to ensure data integrity during training data storage and transfer. | 2 | D/V |
+| **1.2.5** | **Verify that** automated integrity monitoring is applied to guard against unauthorized modifications or corruption of training data. | 2 | D/V |
+| **1.2.6** | **Verify that** obsolete training data is securely purged or anonymized. | 1 | D/V |
+| **1.2.7** | **Verify that** all training dataset versions are uniquely identified, stored immutably, and auditable to support rollback and forensic analysis. | 3 | D/V |

plugins/code-security-skills/data/aisvs/C1.3.md

@@ -0,0 +1,26 @@
+---
+title: "C1.3 Data Labeling and Annotation Security"
+aisvs_chapter: "C1.3"
+when_to_use:
+  - deploying or reviewing labeling interfaces and annotation platforms
+  - protecting labeling artifacts and annotation data from tampering
+  - handling sensitive information within labels or annotations
+  - ensuring auditability of labeling activities for compliance or forensics
+threats:
+  - unauthorized modification or injection of labels (label poisoning)
+  - exposure of sensitive information in labels or annotation metadata
+  - tampering with labeling audit logs to hide malicious changes
+  - lack of integrity guarantees for labeling artifacts
+summary: "Requirements for access-controlled, auditable labeling processes and protection of sensitive information in labels."
+---
+
+# C1.3 Data Labeling and Annotation Security
+
+Ensure labeling and annotation processes are access-controlled, auditable, and protect sensitive information.
+
+| # | Description | Level | Role |
+| :---: | :--- | :---: | :---: |
+| **1.3.1** | **Verify that** labeling interfaces and platforms enforce access controls and maintain audit logs of all labeling activities. | 1 | D/V |
+| **1.3.2** | **Verify that** cryptographic hashes or digital signatures are applied to labeling artifacts and annotation data to ensure their integrity and authenticity. | 2 | D/V |
+| **1.3.3** | **Verify that** labeling audit logs are tamper-evident and that labeling platforms protect against unauthorized modifications. | 2 | D/V |
+| **1.3.4** | **Verify that** sensitive information in labels is redacted, anonymized, or encrypted using appropriate granularity at rest and in transit. | 2 | D/V |

plugins/code-security-skills/data/aisvs/C1.4.md

@@ -0,0 +1,37 @@
+---
+title: "C1.4 Training Data Quality and Security Assurance"
+aisvs_chapter: "C1.4"
+when_to_use:
+  - implementing ingest or transformation pipelines for training data
+  - defending against data poisoning or unintentional corruption in training data
+  - using automatically generated or weak-supervision labels
+  - applying adversarial training, data augmentation, or robust optimization for model hardening
+  - reviewing training data pipelines for integrity risks
+  - evaluating fine-tuning processes that use external data
+  - assessing RAG knowledge bases for poisoning vectors
+  - auditing model integrity and backdoor risks
+threats:
+  - data poisoning attacks that corrupt model behavior
+  - format errors, nulls, or corrupt data in ingested or transformed datasets
+  - misleading or low-confidence automatically generated labels
+  - label skew or distribution bias introduced during ingest or transformation
+  - adversarial inputs evading model robustness
+  - training data manipulation introducing backdoors or biases
+  - split-view and frontrunning data poisoning
+  - sleeper agent models with dormant triggers
+  - RAG knowledge base poisoning
+  - malicious model serialization
+summary: "Requirements for automated validation, manual spot-checks, poisoning detection, and logged remediation to guarantee dataset reliability."
+---
+
+# C1.4 Training Data Quality and Security Assurance
+
+Combine automated validation, manual spot-checks, and logged remediation to guarantee dataset reliability.
+
+| # | Description | Level | Role |
+| :---: | :--- | :---: | :---: |
+| **1.4.1** | **Verify that** automated tests catch format errors and nulls on every ingest or significant data transformation. | 1 | D |
+| **1.4.2** | **Verify that** training and fine-tuning pipelines implement data integrity validation and poisoning detection techniques (e.g., statistical analysis, outlier detection, embedding analysis) to identify potential data poisoning or unintentional corruption in training data. | 2 | D/V |
+| **1.4.3** | **Verify that** automatically generated labels (e.g., via models or weak supervision) are subject to confidence thresholds and consistency checks to detect misleading or low-confidence labels. | 2 | D/V |
+| **1.4.4** | **Verify that** appropriate defenses, such as adversarial training, data augmentation with perturbed inputs, or robust optimization techniques, are implemented and tuned for relevant models based on risk assessment. | 3 | D/V |
+| **1.4.5** | **Verify that** automated tests catch label skews on every ingest or significant data transformation. | 2 | D |

plugins/code-security-skills/data/aisvs/C1.5.md

@@ -0,0 +1,34 @@
+---
+title: "C1.5 Data Lineage and Traceability"
+aisvs_chapter: "C1.5"
+when_to_use:
+  - tracking the full journey of datasets from source to model input
+  - supporting auditability and incident response for training data
+  - handling synthetic data from augmentation, synthesis, or privacy-preserving techniques
+  - ensuring lineage records are immutable and available for forensics
+  - reviewing training data pipelines for integrity risks
+  - evaluating fine-tuning processes that use external data
+  - assessing RAG knowledge bases for poisoning vectors
+  - auditing model integrity and backdoor risks
+threats:
+  - inability to reconstruct how data was transformed or merged (forensic blind spots)
+  - synthetic data mixed with real data without clear labeling in the pipeline
+  - tampering with or loss of lineage records
+  - lack of traceability for augmentations and merges
+  - training data manipulation introducing backdoors or biases
+  - split-view and frontrunning data poisoning
+  - sleeper agent models with dormant triggers
+  - RAG knowledge base poisoning
+  - malicious model serialization
+summary: "Requirements for tracking dataset lineage from source to model input for auditability and incident response."
+---
+
+# C1.5 Data Lineage and Traceability
+
+Track the full journey of each dataset from source to model input for auditability and incident response.
+
+| # | Description | Level | Role |
+| :---: | :--- | :---: | :---: |
+| **1.5.1** | **Verify that** the lineage of each dataset and its components, including all transformations, augmentations, and merges, is recorded and can be reconstructed. | 1 | D/V |
+| **1.5.2** | **Verify that** lineage records are immutable, securely stored, and accessible for audits. | 2 | D/V |
+| **1.5.3** | **Verify that** lineage tracking covers synthetic data generated via augmentation, synthesis, or privacy-preserving techniques and that all synthetic data is clearly labeled and distinguishable from real data throughout the pipeline. | 2 | D/V |

plugins/code-security-skills/data/aisvs/C10.1.md

@@ -0,0 +1,33 @@
+---
+title: "C10.1 Model Alignment & Safety"
+aisvs_chapter: "C10.1"
+when_to_use:
+  - reviewing LLM applications that accept user input
+  - assessing chatbots or AI assistants for injection risks
+  - red-teaming AI applications for prompt manipulation
+  - reviewing LLM apps used in high-stakes domains (medical, legal, financial)
+  - assessing grounding and fact-checking mechanisms in LLM outputs
+  - auditing user-facing AI applications for overreliance risks
+threats:
+  - direct prompt injection via user input
+  - jailbreaking to bypass safety guidelines
+  - adversarial suffix attacks
+  - hallucinated facts presented as authoritative
+  - fabricated legal cases, medical advice, or technical references
+  - reputational and legal liability from incorrect AI outputs
+summary: "Alignment test-suite, refusal and safe-completion guard-rails, harmful-content metrics, counter-jailbreak training."
+---
+
+## 10.1 Model Alignment & Safety
+
+Guard against harmful or policy-breaking outputs.
+
+| # | Description | Level | Role |
+|:--------:|---------------------------------------------------------------------------------------------------------------------|:---:|:---:|
+| **10.1.1** | **Verify that** an alignment test-suite (red-team prompts, jailbreak probes, disallowed content) is version-controlled and run on every model release. | 1 | D/V |
+| **10.1.2** | **Verify that** refusal and safe-completion guard-rails are enforced. | 1 | D |
+| **10.1.3** | **Verify that** an automated evaluator measures harmful-content rate and flags regressions beyond a set threshold. | 2 | D/V |
+| **10.1.4** | **Verify that** counter-jailbreak training is documented and reproducible. | 2 | D |
+| **10.1.5** | **Verify that** formal policy-compliance proofs or certified monitoring cover critical domains. | 3 | V |
+
+---

plugins/code-security-skills/data/aisvs/C10.2.md

@@ -0,0 +1,12 @@
+## 10.2 Adversarial-Example Hardening
+
+Increase resilience to manipulated inputs. Robust adversarial-training and benchmark scoring are the current best practice.
+
+| # | Description | Level | Role |
+|:--------:|---------------------------------------------------------------------------------------------------------------------|:---:|:---:|
+| **10.2.1** | **Verify that** project repositories include adversarial-training configurations with reproducible seeds. | 1 | D |
+| **10.2.2** | **Verify that** adversarial-example detection raises blocking alerts in production pipelines. | 2 | D/V |
+| **10.2.4** | **Verify that** certified‐robustness proofs or interval-bound certificates cover at least the top critical classes. | 3 | V |
+| **10.2.5** | **Verify that** regression tests use adaptive attacks to confirm no measurable robustness loss. | 3 | V |
+
+---

plugins/code-security-skills/data/aisvs/C10.3.md

@@ -0,0 +1,27 @@
+---
+title: "C10.3 Membership-Inference Mitigation"
+aisvs_chapter: "C10.3"
+when_to_use:
+  - reviewing LLM apps that handle PII, credentials, or confidential data
+  - assessing training data pipelines for data leakage risks
+  - evaluating LLM outputs for unintended information exposure
+  - auditing access controls on LLM-generated responses
+threats:
+  - PII leakage through model outputs
+  - training data extraction and model inversion attacks
+  - proprietary algorithm or business logic exposure
+  - credential or API key disclosure via system prompts
+summary: "Per-query entropy regularization or temperature-scaling; ε-bounded differentially-private optimization; attack simulations (shadow-model or black-box)."
+---
+
+## 10.3 Membership-Inference Mitigation
+
+Limit the ability to decide whether a record was in training data. Differential privacy and confidence-score masking remain the most effective known defenses.
+
+| # | Description | Level | Role |
+|:--------:|---------------------------------------------------------------------------------------------------------------------|:---:|:---:|
+| **10.3.1** | **Verify that** per-query entropy regularization or temperature-scaling reduces overconfident predictions. | 1 | D |
+| **10.3.2** | **Verify that** training employs ε-bounded differentially-private optimization for sensitive datasets. | 2 | D |
+| **10.3.3** | **Verify that** attack simulations (shadow-model or black-box) show attack AUC ≤ 0.60 on held-out data. | 2 | V |
+
+---

plugins/code-security-skills/data/aisvs/C10.4.md

@@ -0,0 +1,27 @@
+---
+title: "C10.4 Model-Inversion Resistance"
+aisvs_chapter: "C10.4"
+when_to_use:
+  - reviewing LLM apps that handle PII, credentials, or confidential data
+  - assessing training data pipelines for data leakage risks
+  - evaluating LLM outputs for unintended information exposure
+  - auditing access controls on LLM-generated responses
+threats:
+  - PII leakage through model outputs
+  - training data extraction and model inversion attacks
+  - proprietary algorithm or business logic exposure
+  - credential or API key disclosure via system prompts
+summary: "Sensitive attributes never directly output; query-rate limits; training with privacy-preserving noise."
+---
+
+## 10.4 Model-Inversion Resistance
+
+Prevent reconstruction of private attributes. Recent surveys emphasize output truncation and DP guarantees as practical defenses.
+
+| # | Description | Level | Role |
+|:--------:|---------------------------------------------------------------------------------------------------------------------|:---:|:---:|
+| **10.4.1** | **Verify that** sensitive attributes are never directly output; where needed, use buckets or one-way transforms. | 1 | D |
+| **10.4.2** | **Verify that** query-rate limits throttle repeated adaptive queries from the same principal. | 1 | D/V |
+| **10.4.3** | **Verify that** the model is trained with privacy-preserving noise. | 2 | D |
+
+---