Li Maestro Evaluate

li_maestro_evaluate — Interactive Q&A Threat Modeling

This skill implements the MAESTRO threat modeling process as an interactive conversation with two analysis modes:

1. MVTM Checklist Mode — A structured 10-item Minimum Viable Threat Model checklist, extended with Chinese regulatory requirements (《网络安全法》《数据安全法》《个人信息保护法》《人工智能安全治理框架》2.0, GB/T 45654-2025). Best for: quick assessments, low-risk systems, initial scoping. Delivers: pass/fail evaluation against the MVTM standard with compliance mapping.

2. Full Assessment Mode — The complete MAESTRO 10-phase threat modeling process with interactive Q&A through all phases. Delivers a comprehensive risk assessment with multi-format outputs.

Both modes produce .md (Markdown), .docx (Word), .xlsx (Excel) outputs with AI risk classification mapping to China's 《人工智能安全治理框架》2.0 版 (three categories, nine subcategories).

Targets two types of systems:

1. Agentic AI systems — LLM-based agents, multi-agent systems, MCP/A2A ecosystems
2. OpenCode Skills — "code + prompt" hybrid artifacts distributed via clawhub.ai or local install. Skills are unique threat modeling targets because they contain both machine-executable code AND model-executable prompts. Traditional code scanning misses prompt injection; prompt review misses code-level data exfiltration. MAESTRO's layered architecture decomposes skill risk across all 7 layers plus Layer S0 (Skill Content meta-layer), which explicitly checks for combined code+prompt attacks, runtime remote content loading, and multi-skill collusion.

Phases 6-10 can be auto-completed by AI. When Phase 5 is complete, the agent will ask whether you want to auto-complete the remaining phases. If you choose auto-complete, the AI generates all outputs without further interactive Q&A — you review the results at the end.

Reference: OWASP MAESTRO Threat Modeling Playbook v1.0 Source: https://github.com/agentic-threat-modeling/MAESTRO

---

Conversation Architecture

                ┌──────────────────────────────────┐
                │  PRE-ENGAGEMENT                  │  Step 0: Mode selection
                │  (5-10 min)                      │  Steps 1-4: decision tree + consent + setup
                └─────────┬────────────────────────┘
                          │
          ┌───────────────┴───────────────┐
          ▼                               ▼
┌─────────────────────┐       ┌──────────────────────────┐
│ MVTM CHECKLIST MODE │       │  FULL ASSESSMENT MODE    │
│ 10-item checklist   │       │  10-phase interactive Q&A│
└─────────┬───────────┘       └──────────┬───────────────┘
          │                              │
          ▼                              ▼
┌─────────────────────┐       ┌──────────────────────┐
│ Check 1: Business   │       │ PHASE 1: Business    │
│ Context (5 items)   │       │ Context              │
├─────────────────────┤       ├──────────────────────┤
│ Check 2:            │       │ PHASE 2:             │
│ Architecture (7 L)  │       │ Architecture         │
├─────────────────────┤       ├──────────────────────┤
│ Check 3-5: Actors,  │       │ PHASES 3-5:          │
│ Boundaries, Assets  │       │ Actors/Boundaries/   │
│                     │       │ Assets (any order)   │
├─────────────────────┤       ├──────────────────────┤
│ Check 6: Per-Layer  │       │ PHASE 6: Threat      │
│ Threats (L1-L6)     │──► AI │ Identification       │──► AI
├─────────────────────┤Derives├──────────────────────┤Derives
│ Check 7: Cross-Layer│       │ PHASE 7: Mitigation  │
│ Patterns            │       │ Planning             │
├─────────────────────┤       ├──────────────────────┤
│ Check 8: Mitigations│       │ PHASE 8: Code        │
│ (≥5)                │       │ Validation           │
├─────────────────────┤       ├──────────────────────┤
│ Check 9: Residual   │       │ PHASE 9: Residual    │
│ Risk                │       │ Risk                 │
├─────────────────────┤       ├──────────────────────┤
│ Check 10: Output    │       │ PHASE 10: Output     │
│ .md/.docx/.xlsx     │       │ .md/.docx/.xlsx      │
└─────────────────────┘       └──────────────────────┘

---

Pre-Engagement Protocol

Step 0 — Analysis Mode Selection

Before the decision tree, ask the user which analysis mode to use:

[Pre-Engagement — Mode Selection]

This session supports two analysis modes:

A) **MVTM Checklist (Minimum Viable Threat Model)**
   Structured 10-item checklist extended with Chinese regulatory requirements
   (《网络安全法》《数据安全法》《个人信息保护法》《人工智能安全治理框架》2.0).
   Best for: quick assessments, low-risk systems, initial scoping.
   Delivers: pass/fail evaluation with compliance mapping.

B) **Full Risk Assessment**
   Complete MAESTRO 10-phase threat modeling process with interactive Q&A.
   Best for: critical systems, high-risk deployments, compliance evidence.
   Delivers: comprehensive risk assessment with multi-format outputs.

Which mode would you like? (A / B)

After selection, the user enters the project name in Step 2. At that point, record this selection by setting analysis_mode in the state.json created in Step 2:

• If A → "analysis_mode": "mvtm_checklist"
• If B → "analysis_mode": "full_assessment"

Then proceed to Step 1.

Step 1 — Dual Decision Tree (MAESTRO + China-Specific)

Ask these 10 questions in two stages:

Stage A — MAESTRO 5 Questions (risk-driven, one at a time):

Q1: Is the system business-critical or safety-related?
    (Would downtime or compromise cause major revenue loss or safety risk?)
Q2: Does it process Confidential or Restricted data?
    (PII, financial records, health data, trade secrets, credentials?)
Q3: Is it externally facing?
    (Accessed by public users or partner APIs over the internet?)
Q4: Does it operate with full autonomy?
    (No human-in-the-loop for decisions or actions?)
Q5: Is this a multi-agent system?
    (Multiple AI agents communicating and coordinating?)

Decision Tree — MAESTRO:

Stage B — China-Specific 5 Criteria (regulatory-driven, ask after Stage A):

Q6: Is this system part of Critical Information Infrastructure (CII)?
    (Per 《网络安全法》Art.31 and 《关键信息基础设施安全保护条例》)
Q7: Does the system process Important Data or Core Data?
    (Per 《数据安全法》data classification & grading system)
Q8: Does this system provide generative AI services to the public?
    (Per 《生成式人工智能服务管理暂行办法》— requires security assessment + algorithm filing)
Q9: Does the system involve 3+ autonomous agents?
    (Multi-agent threshold for cross-layer and confused-deputy risks)
Q10: Does this system involve cross-border data transfer or overseas deployment?
    (Per 《数据安全法》data export security assessment requirements)

China-Specific Override Logic (applies regardless of analysis_mode):

Scope Limitation Warning (for MVTM mode):

If in MVTM mode AND any Stage A MAESTRO question triggers Full/Standard OR any Stage B China criterion is YES, display:

⚠ Scope Limitation Warning:
Your system has characteristics that the MAESTRO MVTM standard recommends
against treating as "minimum viable." Specifically:
  - [List triggered criteria]
  - [List triggered China criteria]

Per MAESTRO + China regulatory guidance, this system requires at least
[Standard/Full] depth analysis. Performing only the MVTM checklist is a
scope limitation.

Do you want to:
  A) Continue with MVTM Checklist (scope limitation will be recorded in output)
  B) Switch to Full Assessment (recommended)
  C) Continue with MVTM + add explicit scope warning in report

If user chooses A or C → record in state.json "mvtm_scope_warning": true and add warning banner in all output files.

Step 2 — Project Setup

Please provide a short project name (e.g., "devops-agent", "trading-bot"):
→ [user provides name]

Each evaluation run creates an isolated timestamped output directory inside threat-models/. Use a -mvtm- infix for MVTM mode to distinguish from full assessments. Create the directory with explicit filesystem commands:

# Powershell — creates the per-run output directory
if ($analysisMode -eq "mvtm_checklist") {
  $runDir = "threat-models/$project-mvtm-$(Get-Date -Format 'yyyyMMdd-HHmm')"
} else {
  $runDir = "threat-models/$project-$(Get-Date -Format 'yyyyMMdd-HHmm')"
}
New-Item -ItemType Directory -Path $runDir -Force
# Initialize state.json with full schema (see Step 4 for field descriptions)
$stateJson = @"
{
  "project": "$project",
  "analysis_mode": "$analysisMode",
  "analysis_depth": "$depth",
  "mvtm_scope_warning": $scopeWarning,
  "created": "$(Get-Date -Format 'yyyy-MM-ddTHH:mm:ssZ')",
  "updated": "$(Get-Date -Format 'yyyy-MM-ddTHH:mm:ssZ')",
  "system_type": "unknown",
  "uses_mcp": false,
  "target_type": "agentic_ai_system",
  "phases": {
    "1": {"status":"pending","output_file":"01-business-context.md"},
    "2": {"status":"pending","output_file":"02-architecture.md"},
    "3": {"status":"pending","output_file":"03-threat-actors.md"},
    "4": {"status":"pending","output_file":"04-trust-boundaries.md"},
    "5": {"status":"pending","output_file":"05-asset-flows.md"},
    "6": {"status":"pending","output_file":"06-threat-register.md"},
    "7": {"status":"pending","output_file":"07-mitigations.md"},
    "8": {"status":"pending","output_file":"08-code-validation.md"},
    "9": {"status":"pending","output_file":"09-residual-risk.md"},
    "10": {"status":"pending","output_file":"10-output-summary.md"},
    "10j": {"status":"pending","output_file":"threat-model.json"}
  },
  "mvtm_checklist": null,
  "threat_count": 0,
  "mitigation_count": 0,
  "files_read": [],
  "version_metadata": {
    "playbook_version": "1.2.0",
    "analyst": "AI Agent (Claude Code)",
    "schema_version": "1.2.0",`n    "template_version": "1.0.0"
  }
}
"@
$stateJson | Set-Content -Path "$runDir/state.json"

# Bash equivalent — writes initial state.json with variable expansion via printf
if [ "$analysis_mode" = "mvtm_checklist" ]; then
  runDir="threat-models/${project}-mvtm-$(date +%Y%m%d-%H%M)"
else
  runDir="threat-models/${project}-$(date +%Y%m%d-%H%M)"
fi
mkdir -p "$runDir"
created="$(date -Iseconds)"
printf '{
  "project": "%s",
  "analysis_mode": "%s",
  "mvtm_scope_warning": false,
  "created": "%s",
  "updated": "%s",
  "system_type": "unknown",
  "uses_mcp": false,
  "target_type": "agentic_ai_system",
  "phases": {
    "1":{"status":"pending","output_file":"01-business-context.md"},
    "2":{"status":"pending","output_file":"02-architecture.md"},
    "3":{"status":"pending","output_file":"03-threat-actors.md"},
    "4":{"status":"pending","output_file":"04-trust-boundaries.md"},
    "5":{"status":"pending","output_file":"05-asset-flows.md"},
    "6":{"status":"pending","output_file":"06-threat-register.md"},
    "7":{"status":"pending","output_file":"07-mitigations.md"},
    "8":{"status":"pending","output_file":"08-code-validation.md"},
    "9":{"status":"pending","output_file":"09-residual-risk.md"},
    "10":{"status":"pending","output_file":"10-output-summary.md"},
    "10j":{"status":"pending","output_file":"threat-model.json"}
  },
  "mvtm_checklist": null,
  "threat_count": 0,
  "mitigation_count": 0,
  "files_read": [],
  "version_metadata": {
    "playbook_version": "1.2.0",
    "analyst": "AI Agent (Claude Code)",
    "schema_version": "1.2.0",`n    "template_version": "1.0.0"
  }
}' "$project" "$analysis_mode" "$created" "$created" > "$runDir/state.json"

This produces run-isolated directory trees:

threat-models/
│   Full Assessment runs:
├── -20260701-1430/      ← Full assessment Run 1
│   ├── state.json
│   ├── 01-business-context.md
│   ├── 02-architecture.md
│   ├── 03-threat-actors.md
│   ├── 04-trust-boundaries.md
│   ├── 05-asset-flows.md
│   ├── 06-threat-register.md
│   ├── 07-mitigations.md
│   ├── 08-code-validation.md
│   ├── 09-residual-risk.md
│   ├── 10-output-summary.md
│   ├── threat-model.json
│   ├── 11-ai-risk-classification.md
│   ├── 11-ai-risk-classification.docx
│   ├── 11-ai-risk-classification.xlsx
│   └── 12-skill-risk-assessment.md      ← only when target_type=opencode_skill
│   MVTM Checklist runs:
├── -mvtm-20260701-1500/  ← MVTM Run 1
│   ├── state.json
│   ├── 01-mvtm-checklist.md             ← Core MVTM output
│   ├── threat-model.json
│   ├── 11-ai-risk-classification.md
│   ├── 11-ai-risk-classification.docx
│   ├── 11-ai-risk-classification.xlsx
│   └── 12-skill-risk-assessment.md      ← only when target_type=opencode_skill
├── -20260702-0900/      ← Full assessment Run 2
│   ├── state.json
│   └── ...
└── ...

Why timestamps? Threat models are living documents. Each iteration (re-assessment, periodic review, architecture change) gets its own directory, preserving the audit trail. Use the resumption protocol (line ~1618) to re-enter any specific run by reading its state.json.

Step 3 — Data Handling Consent

Present this exact notice:

Data Handling Notice: This threat modeling session uses the AI provider API. All content you provide — system descriptions, architecture details, and any source code reviewed during Phase 8 — will be transmitted for processing. Do you confirm this is acceptable under your organization's data handling policies?

If user declines → halt engagement. Recommend using the MAESTRO playbook as standalone documentation.

Step 4 — Verify state.json

{
  "project": "",
  "analysis_mode": "mvtm_checklist|full_assessment",
  "analysis_depth": "full|standard|lightweight",
  "mvtm_scope_warning": false,
  "created": "",
  "updated": "",
  "system_type": "unknown",
  "uses_mcp": false,
  "target_type": "agentic_ai_system",
  "phases": {
    "1": {"status":"pending","output_file":"01-business-context.md"},
    "2": {"status":"pending","output_file":"02-architecture.md"},
    "3": {"status":"pending","output_file":"03-threat-actors.md"},
    "4": {"status":"pending","output_file":"04-trust-boundaries.md"},
    "5": {"status":"pending","output_file":"05-asset-flows.md"},
    "6": {"status":"pending","output_file":"06-threat-register.md"},
    "7": {"status":"pending","output_file":"07-mitigations.md"},
    "8": {"status":"pending","output_file":"08-code-validation.md"},
    "9": {"status":"pending","output_file":"09-residual-risk.md"},
    "10": {"status":"pending","output_file":"10-output-summary.md"},
    "10j": {"status":"pending","output_file":"threat-model.json"}
  },
  "mvtm_checklist": {
    "1_business_context":  {"status":"pending","passed":0,"total":5,"items":{}},
    "2_architecture":     {"status":"pending","passed":0,"total":7,"items":{}},
    "3_threat_actors":    {"status":"pending","passed":0,"total":5,"items":{}},
    "4_trust_boundaries": {"status":"pending","passed":0,"total":4,"items":{}},
    "5_asset_flows":      {"status":"pending","passed":0,"total":6,"items":{}},
    "6_layer_threats":   {"status":"pending","passed":0,"total":5,"items":{}},
    "7_cross_layer":      {"status":"pending","passed":0,"total":4,"items":{}},
    "8_mitigations":      {"status":"pending","passed":0,"total":6,"items":{}},
    "9_residual_risk":    {"status":"pending","passed":0,"total":8,"items":{}},
    "10_output":          {"status":"pending","passed":0,"total":4,"items":{}}
  },
  "threat_count": 0,
  "mitigation_count": 0,
  "files_read": [],
  "version_metadata": {
    "playbook_version": "1.0.0",
    "analyst": "AI Agent (OpenCode)",
    "schema_version": "1.2.0",`n    "template_version": "1.0.0"
  }
}

When analysis_mode == "mvtm_checklist": The phases object is not used for progress tracking. Instead, use mvtm_checklist to track per-sub-item status. Set each check item's status to pending, in_progress, complete, or skipped. Sub-items use passed, failed, or pending.

When analysis_mode == "full_assessment": The phases object tracks progress as before. The mvtm_checklist object is unused.

Important: The state.json was created in Step 2. If it does not exist (e.g., manual execution), write it now using the schema above.

Per-sub-item status example (for resumption):

"mvtm_checklist": {
  "1_business_context": {
    "status": "in_progress",
    "passed": 3,
    "total": 5,
    "items": {
      "1.1": {"status": "passed", "value": "Yes", "note": ""},
      "1.2": {"status": "passed", "value": "Yes", "note": ""},
      "1.3": {"status": "failed", "value": "No", "note": "等保定级未完成"},
      "1.4": {"status": "passed", "value": "Yes", "note": ""},
      "1.5": {"status": "pending"}
    }
  }
}

---

Conversation Rules

Follow these rules strictly throughout the engagement:

1. Phase/Check indicator: Start every response with the mode marker:
   • MVTM mode: [MVTM Check N/10]
   • Full mode: [Phase N/10] or [Pre-Engagement]
2. One question at a time in Full mode. In MVTM mode, batch related sub-items from the same check (e.g., present all 5 sub-items of Check 1 together for efficiency).
3. Closed questions only. Use "What LLM provider?" not "Tell me about your system."
4. Confirm after each check/phase: "Check X complete. Passed Y/Z. Ready for Check X+1?" or "Phase X complete. Summary: [key findings]. Ready for Phase X+1?"
5. Handle "I don't know": If user is unsure, offer defaults or simplified options.
6. Lightweight path (Full mode only): If depth=lightweight, tell the user: "Since your system is low-risk, we'll use the Lightweight path: brief Phases 1-2, then jump to Phase 6."
7. State persistence: Update state.json after every check/phase completion.
8. Disclaimer: Include AI-generated disclaimer in every output file.
9. ID validation: After Check 6-7 (MVTM) or Phases 6-7 (Full), cross-reference all IDs against source files.
10. Progressive summarization: Before each transition, show accumulated summary with pass/fail status for MVTM mode.

---

Mode Selection Gate

After completing the Pre-Engagement Protocol, read analysis_mode from state.json:

IF analysis_mode == "mvtm_checklist":
    → Follow the "MVTM Checklist Workflow" section below
    → Output directory: threat-models/-mvtm-/
    → Primary output: 01-mvtm-checklist.md

IF analysis_mode == "full_assessment":
    → Follow the "Phase 1/10 — Business Context Analysis" section
    → Output directory: threat-models/-/
    → Primary output: 10-output-summary.md

---

MVTM Checklist Workflow (10 Items)

Reference: MAESTRO Official MVTM Standard + Chinese regulatory extension (《网络安全法》《数据安全法》《个人信息保护法》《人工智能安全治理框架》2.0, GB/T 45654-2025, GB/T 45953-2025)

This workflow walks through 10 structured checklist items. Each item contains multiple sub-items. The agent MUST:

1. Display the sub-items as a batch (not one at a time)
2. Ask the user to confirm Yes/No per sub-item
3. Record each result in state.json.mvtm_checklist..items..status
4. After completing each check item, update the pass count and status

Phase marker pattern: [MVTM Check N/10 — Name]

Scoring thresholds for each check item:

---

MVTM Check 1/10 — Business Context Documentation

Requirement: System function, users, criticality, data processing activities, and data classification documented.

Phase marker: [MVTM Check 1/10 — Business Context]

Conversation:

[MVTM Check 1/10 — Business Context]

I need to verify 5 items about your system's business context.
Please answer each:

  1.1 Is the system's business function and purpose clearly described?
      → Yes / No  (If No: what is missing?)
      
  1.2 Are system users/user groups identified?
      → Yes / No  (If No: who are the users?)
      
  1.3 Has the system's criticality/importance level been assigned?
      → Yes / No  (If No: what criticality would you assign?)
      [Prompt: Per 等保2.0 — Levels 1-4]
      
  1.4 Are data processing activities (collection, storage, use, 
      transmission, deletion) described?
      → Yes / No  (If No: what data activities exist?)
      [Prompt: 《数据安全法》Art.27 requires full lifecycle management]
      
  1.5 Does the system process Important Data or Core Data?
      → Yes / No
      [Prompt: If Yes, must include in Important Data catalog]

After user responds, update state.json and show summary:

Check 1 results: ✅ Passed 4/5 | ❌ 1.3 (No criticality assigned)
Status: ⚠ Partial
China compliance: 1.4 → 《数据安全法》Art.27, 1.5 → 《数据安全法》data classification

State update example:

"mvtm_checklist": {
  "1_business_context": {
    "status": "complete",
    "passed": 4,
    "total": 5,
    "items": {
      "1.1": {"status":"passed","value":"Yes","note":""},
      "1.2": {"status":"passed","value":"Yes","note":"Internal users"},
      "1.3": {"status":"failed","value":"No","note":"等保定级未完成"},
      "1.4": {"status":"passed","value":"Yes","note":""},
      "1.5": {"status":"passed","value":"Yes","note":"涉及重要数据"}
    }
  }
}

Confirmation:

Check 1 complete: ✅ 4/5 passed (⚡ Partial). Key gap: criticality not assigned (等保2.0 compliance risk). Ready for Check 2 (Architecture)?

---

MVTM Check 2/10 — Architecture Mapped to MAESTRO Layers

Requirement: System architecture mapped to all 7 MAESTRO layers.

Phase marker: [MVTM Check 2/10 — Architecture]

Conversation:

[MVTM Check 2/10 — Architecture]

I need to verify that your system's architecture maps to each
MAESTRO layer. Let me ask about each layer:

  L1 (Foundation Model):
  2.1 Is the model provider, model version, and prompt template identified?
      → Yes / No (If No: what LLM does the system use?)
      [China: Model provider data policy must comply with 《数据安全法》]

  L2 (Data Operations):
  2.2 Are data stores, vector databases, and RAG data sources identified?
      → Yes / No (If No: what data stores exist?)
      [China: Training data must be authentic, accurate, objective, diverse]

  L3 (Agent Frameworks):
  2.3 Are agent count, MCP servers, and message queues identified?
      → Yes / No (If No: what agent framework is used?)
      [China: Agent security is a key technology direction in 《人工智能安全标准体系》]

  L4 (Deployment Infrastructure):
  2.4 Are containers, image registries, key managers, and DNS identified?
      → Yes / No (If No: what infrastructure?)
      [China: 等保2.0 baseline config management and access control]

  L5 (Evaluation & Observability):
  2.5 Are logging, monitoring, and approval systems identified?
      → Yes / No (If No: how is the system monitored?)
      [China: 《网络安全法》Art.21 requires log retention ≥6 months]

  L6 (Security & Compliance):
  2.6 Are IAM, RBAC, key management, and code signing identified?
      → Yes / No (If No: what security controls exist?)
      [China: 网络安全等级保护 registration required]

  L7 (Agent Ecosystem):
  2.7 Are external systems (Git, cloud APIs, container registries) identified?
      → Yes / No (If No: what external integrations?)
      [China: Supply chain security per GB/T 45953-2025]

Confirmation:

Check 2 complete: ✅ 6/7 passed (⚡ Partial). Layers covered: L1-L7. Key gap: L5 observability not fully mapped — affects log retention compliance (《网络安全法》Art.21). Ready for Check 3?

---

MVTM Check 3/10 — Three Threat Actors

Requirement: At least three threat actor types identified with motivations and attack paths.

Phase marker: [MVTM Check 3/10 — Threat Actors]

Conversation:

[MVTM Check 3/10 — Threat Actors]

Let me check which threat actor types are covered for your system:

  3.1 External Attackers — e.g., prompt injection, data theft, DoS
      → Identified / Not relevant
      [China supplement: guard against organized cybercrime data poisoning]

  3.2 Malicious Insiders — e.g., backdoor insertion, data exfiltration
      → Identified / Not relevant
      [China: 《网络安全法》requires 主体责任 (primary responsibility)]

  3.3 Compromised Dependencies — e.g., third-party library → pipeline
      → Identified / Not relevant
      [China: Supply chain security is a 《人工智能安全标准体系》management direction]

  3.4 Compromised Agents — e.g., single agent compromised → message poisoning
      → Identified / Not relevant
      [China: Agent security is a new compliance focus]

  3.5 Nation-State APT — e.g., long-term CII penetration
      → Identified / Not relevant
      [China: CII operators must conduct annual security assessment]

MVTM minimum: At least 3 of 5 must be "Identified." Items 3.1, 3.2, 3.3 are the core three. Items 3.4 and 3.5 are optional but recommended.

Confirmation:

Check 3 complete: ✅ 3/5 identified. Core three: External, Insider, Dependency. Ready for Check 4?

---

MVTM Check 4/10 — Trust Boundaries

Requirement: Trust zones, boundary crossing points, risk levels, and controls identified.

Phase marker: [MVTM Check 4/10 — Trust Boundaries]

Conversation:

[MVTM Check 4/10 — Trust Boundaries]

Let me verify trust boundary coverage for your system:

  4.1 External → Agent Processing Layer boundary
      (PR submission, API calls)
      → Identified / Not identified
      Risk level: [Critical / High / Medium / Low]
      Controls: input validation, authentication
      [China: 多AI模型聚合平台 requires enhanced access control]

  4.2 Agent → Infrastructure Control Plane boundary
      (Review pass → triggers deployment)
      → Identified / Not identified
      Risk level: [Critical / High / Medium / Low]
      Controls: IAM policies, approval workflows
      [China: 最小权限原则 is 等保2.0 basic requirement]

  4.3 Agent → Production Environment boundary
      (Config changes, resource creation)
      → Identified / Not identified
      Risk level: [Critical / High / Medium / Low]
      Controls: deployment approval, rollback mechanisms
      [China: Must have capability to switch to manual/traditional systems]

  4.4 Agent ↔ Agent boundary
      (Message queue communication)
      → Identified / Not identified
      Risk level: [Critical / High / Medium / Low]
      Controls: message signing, access control
      [China: Must comply with 《数据安全法》transmission encryption]

Confirmation:

Check 4 complete: ✅ 3/4 passed. Boundary 4.4 (Agent↔Agent) not identified — this impacts inter-agent security compliance. Ready for Check 5?

---

MVTM Check 5/10 — Key Assets and Flows

Requirement: Critical assets identified with protection measures and data flow paths.

Phase marker: [MVTM Check 5/10 — Asset Flows]

Conversation:

[MVTM Check 5/10 — Asset Flows]

Let me verify critical asset coverage. For each asset type:

  5.1 Source Code
      → Identified / Not identified
      Protections: [branch protection / commit signing / access audit / encryption]
      [China: Source code audit is statutory (《网络安全法》Art.63)]

  5.2 Infrastructure Credentials
      → Identified / Not identified
      Protections: [key manager / auto rotation / access audit]
      [China: Credential management is 等保2.0 data encryption requirement]

  5.3 IaC State Files (e.g., Terraform state)
      → Identified / Not identified
      Protections: [encryption / version control / access logs]
      [China: State files are 重要数据 — must be classified and graded]

  5.4 Container Images
      → Identified / Not identified
      Protections: [signature verification / vulnerability scan / digest pinning]
      [China: Supply chain security per GB/T 45953-2025]

  5.5 Audit Logs
      → Identified / Not identified
      Protections: [immutable storage / retention ≥6 months / encryption]
      [China: 《网络安全法》Art.21 mandates ≥6 month retention]

  5.6 System Prompts
      → Identified / Not identified
      Protections: [version control / access control / no log leakage]
      [China: Prompt security is 《人工智能安全标准体系》"safety fence" direction]

Confirmation:

Check 5 complete: ✅ 5/6 passed. Asset 5.6 (System Prompts) not yet identified — affects 《人工智能安全标准体系》safety fence compliance. Ready for Check 6?

---

MVTM Check 6/10 — Per-Layer Threat Assessment (Agent-Driven)

AI Auto-Generation: This check is AGENT-DRIVEN. The AI analyzes architecture, actors, boundaries, and assets from Checks 1-5, then generates per-layer threat findings. The user confirms or modifies them.

Phase marker: [MVTM Check 6/10 — Per-Layer Threats]

Procedure:

1. The agent scans the accumulated data from Checks 1-5
2. The agent applies the 4 agentic risk factors (Non-Determinism, Autonomy, Identity Mgmt, A2A Communication)
3. The agent walks the per-layer checklist (L1, L2, L3, L4, L6) and suggests threats
4. The user confirms each layer's findings
5. Blindspot vectors BV-1 through BV-12 are also checked

Conversation:

[MVTM Check 6/10 — Per-Layer Threats]

Based on your architecture, actors, boundaries, and assets from Checks 1-5,
I've analyzed threats for each MVTM-required layer:

  L1 (Foundation Model):
  I found these potential threats:
    ✓ T6 Prompt Injection — likely (Critical)
      [Agent justification: system uses user-provided prompts → LLM → tool calls]
    ✓ T1 Memory Poisoning — possible (High)
      [Agent justification: shared memory between agents without auth]
    - BV-1 Context Window Poisoning — unlikely (Low)
  
  Do you agree with the L1 findings?
  → Yes (confirm all) / Modify / Add more

  L2 (Data Operations):
  I found:
    ✓ T18 RAG Input Manipulation — possible (High)
    ✓ T28 RAG Data Exfiltration — possible (Medium)
  
  Do you agree with the L2 findings?
  → Yes / Modify / Add more

  L3 (Agent Frameworks):
  I found:
    ✓ T2 Tool Misuse — likely (Critical)
    ✓ T20 Framework Code Injection — possible (High)
  
  Do you agree with the L3 findings?
  → Yes / Modify / Add more

  L4 (Deployment Infrastructure):
  I found:
    ✓ T3 Privilege Compromise — possible (High)
    ✓ BV-3 Dependency Confusion — possible (Medium)
  
  Do you agree with the L4 findings?
  → Yes / Modify / Add more

  L6 (Security & Compliance):
  I found:
    ✓ T45 Insufficient Permission Isolation — possible (High)
    ✓ T46 Data Residency Violation — possible (Medium)
  
  Do you agree with the L6 findings?
  → Yes / Modify / Add more

After all layers confirmed, update state.json:

"mvtm_checklist": {
  "6_layer_threats": {
    "status": "complete",
    "passed": 5,
    "total": 5,
    "items": {
      "6.1": {"status":"passed","value":"Confirmed","note":"L1: 2 threats (Critical+High)"},
      "6.2": {"status":"passed","value":"Confirmed","note":"L2: 2 threats (High+Medium)"},
      "6.3": {"status":"passed","value":"Confirmed","note":"L3: 2 threats (Critical+High)"},
      "6.4": {"status":"passed","value":"Confirmed","note":"L4: 2 threats (High+Medium)"},
      "6.5": {"status":"passed","value":"Confirmed","note":"L6: 2 threats (High+Medium)"}
    }
  }
}

Confirmation:

Check 6 complete: All 5 layers assessed. Total threats identified: [N]. Top risk: [top threat]. Ready for Check 7?

---

MVTM Check 7/10 — Cross-Layer Threat Patterns (Agent-Driven)

AI Auto-Generation: The agent analyzes whether each cross-layer pattern applies, using data from prior checks. The user confirms.

Phase marker: [MVTM Check 7/10 — Cross-Layer Threats]

Conversation:

[MVTM Check 7/10 — Cross-Layer Patterns]

Based on your architecture, I've evaluated the 4 cross-layer patterns:

  7.1 PR Injection → Production Deployment (L1→L3→L4→L5)
      → Threat exists / Not applicable
      [Defense: 体系对抗体系 — cross-layer defense required]

  7.2 Infrastructure Drift (L1→L4→L6)
      → Threat exists / Not applicable
      [China: LLM-hallucinated config changes require policy constraint validation]

  7.3 Compromised Dependency Propagation (L2→L3→L4→L7)
      → Threat exists / Not applicable
      [China: Supply chain security per GB/T 45953-2025]

  7.4 Confused Deputy / Agent Spoofing (L3→L4)
      → Threat exists / Not applicable
      [China: Agent permissions must follow 最小必要 principle]

Confirmation:

Check 7 complete: [X] patterns confirmed. Ready for Check 8?

---

MVTM Check 8/10 — Mitigation Planning

Requirement: At least 5 mitigations planned, with ≥1 Preventive AND ≥1 Detective for Critical threats.

Phase marker: [MVTM Check 8/10 — Mitigations]

Requirements by risk level:

Conversation:

[MVTM Check 8/10 — Mitigations]

Based on the threats identified in Checks 6-7, let me suggest mitigations.
Please confirm or modify for each:

  8.1 Input Sanitization + Injection Protection
      Addresses: T6 (Intent Breaking / Prompt Injection)
      Priority: 🚨 Immediate
      → Planned / Not planned
      [China: 《AI治理框架》2.0 requires input anomaly monitoring + circuit breaker]

  8.2 Sandbox Isolation
      Addresses: T11 (RCE / Code Execution)
      Priority: 🚨 Immediate
      → Planned / Not planned
      [China: Agent operation must be in 安全可控 environment]

  8.3 Message Signing + Verification
      Addresses: T12 (Agent Communication Poisoning)
      Priority: 🚨 Immediate
      → Planned / Not planned
      [China: Agent communication must comply with 《数据安全法》transmission encryption]

  8.4 OPA Policy-as-Code
      Addresses: T2 (Tool Misuse)
      Priority: ⚡ Short-term
      → Planned / Not planned
      [China: 等保2.0 requires baseline configuration management]

  8.5 Secret Scanning + Auto-Rotation
      Addresses: T3 (Privilege Compromise / Credential Leakage)
      Priority: ⚡ Short-term
      → Planned / Not planned
      [China: 《网络安全法》Art.21 requires data encryption]

  8.6 Human-in-the-Loop Approval Control
      Addresses: T14 (Human Attacks / Bypass HITL)
      Priority: 🚨 Immediate
      → Planned / Not planned
      [China: Must retain 人工复核与干预权限]

MVTM minimum: At least 5 of 6 must be "Planned." If fewer than 5 threats were identified, mark N/A on unused items but flag if total <5.

Mitigation gap check: After all items confirmed, check:

• Critical threats with NO Preventive → ⚠ Gap
• High threats with NO Detective → ⚠ Gap
• Any threat with only 1 mitigation → ⚠ Gap

Confirmation:

Check 8 complete: ✅ [N]/6 mitigations planned. [X] gaps flagged. Ready for Check 9?

---

MVTM Check 9/10 — Residual Risk

Requirement: Record accepted, mitigated, or transferred residual risks with Chinese compliance notes.

Phase marker: [MVTM Check 9/10 — Residual Risk]

Conversation:

[MVTM Check 9/10 — Residual Risk]

For each threat recorded in Check 6, let me calculate residual risk
and document the disposition:

  9.1 T6: Intent Breaking / Prompt Injection (固有风险: Critical)
      → Mitigation: 8.1 Input Sanitization
      → 残余风险: [Critical / High / Medium / Low]
      → 处置: [Mitigate / Accept / Transfer / Defer]
      [China: 《网络安全法》amendment 千万级罚款 — Critical residual must not be accepted]

  9.2 T2: Tool Misuse (固有风险: High)
      → 残余风险: [Critical / High / Medium / Low]
      → 处置: [Mitigate / Accept / Transfer / Defer]
      [China: 等保2.0 baseline violation may trigger 监管通报]

  9.3 T3: Privilege Compromise / Credential Leakage (固有风险: High)
      → 残余风险: [Critical / High / Medium / Low]
      → 处置: [Mitigate / Accept / Transfer / Defer]
      [China: 《数据安全法》Art.27 full lifecycle data security management]

  9.4 T14: Human Attacks / Bypass HITL (固有风险: Critical/High)
      → 残余风险: [Critical / High / Medium / Low]
      → 处置: [Mitigate / Accept / Transfer / Defer]
      [China: 《AI治理框架》2.0 "prevent loss of control" principle]

  9.5 T13: Rogue Agents / Supply Chain (固有风险: High)
      → 残余风险: [Critical / High / Medium / Low]
      → 处置: [Mitigate / Accept / Transfer / Defer]
      [China: GB/T 45953-2025 requires remediation within deadline]

  9.6 T11: RCE / Code Execution (固有风险: Critical)
      → 残余风险: [Critical / High / Medium / Low]
      → 处置: [Mitigate / Accept / Transfer / Defer]
      [China: This is a "不得投入生产" level defect — Critical must be remediated]

  9.7 T12: Agent Communication Poisoning (固有风险: High)
      → 残余风险: [Critical / High / Medium / Low]
      → 处置: [Mitigate / Accept / Transfer / Defer]
      [China: Agent security is 国家标准体系 key direction]

  9.8 T8: Repudiation / State Manipulation (固有风险: High)
      → 残余风险: [Critical / High / Medium / Low]
      → 处置: [Mitigate / Accept / Transfer / Defer]
      [China: State files are 重要数据 — must be encrypted]

Residual risk calculation:

Effective Risk = Inherent Risk Level × (1 - Implementation Status)
- Not Implemented: ×0.0 → Inherent Risk (unchanged)
- Partially Implemented: ×0.5 → e.g., Critical → Medium
- Implemented: ×1.0 → e.g., Critical → Eliminated (Effective Risk = 0)

Risk Level numeric mapping: Low=1, Medium=2, High=3, Critical=4
Example: Critical(4) × (1 - 0.5) = 2.0 → Medium

China-specific residual risk rules:

• CII threats at High residual: must not be "Accepted" — requires remediation plan
• Important Data threats at Medium residual: must remediate within quarter
• All risk acceptance decisions: require management written sign-off ("双罚制")

Aggregate assessment: After all items, check: "Is the aggregate residual risk within the risk appetite defined in Check 1?"

Confirmation:

Check 9 complete: [X] mitigated, [Y] accepted, [Z] deferred. Aggregate residual [is/is not] within risk appetite. China compliance: management sign-off [required / obtained]. Ready for Check 10?

---

MVTM Check 10/10 — Output Export

Requirement: Threat model outputs exported and available for audit/review.

Phase marker: [MVTM Check 10/10 — Output]

Conversation:

[MVTM Check 10/10 — Output Export]

Let me verify that all deliverables are in place:

  10.1 MVTM Checklist Report (01-mvtm-checklist.md) generated
       → Yes / Not yet
       [China: Can serve as supporting material for 安全评估 and 等保定级]

  10.2 Architecture + Data Flow documentation included
       → Yes / Not yet
       [China: CII operators must maintain complete architecture records]

  10.3 Mitigation Implementation Plan documented
       → Yes / Not yet
       [China: Can serve as 合规整改 action basis]

  10.4 Residual Risk approved by management (signed)
       → Yes / Not yet
       [China: 《网络安全法》"双罚制" requires management accountability]

Generate output files:

1. 01-mvtm-checklist.md — Complete checklist with per-item status, scoring summary, scope warning (if any), and China compliance reference appendix IMPORTANT — Must include a parseable Threat Register table with these columns: | Local ID | Threat Name | Layer | Severity | Risk Level | ASI ID | AI Risk Code | Also include a Mitigation Summary table with columns: | Mitigation ID | Catalog ID | Type | Cost | Effectiveness | Status | These table