llm-wiki-security-review

LLM-Wiki Security Review

Goal

Identify security, privacy and data-boundary risks in an LLM-Wiki workflow or skill package, then recommend concrete mitigations and repo artifacts.

Use references/docs/19-security-threat-model.md for the full threat model and control baseline. Use llm-wiki-threat-model when the user needs a full architecture-level threat model rather than a review of an existing setup.

When to use

• The user asks whether an existing LLM-Wiki repo's permissions, MCP/API exposure, exports, cloud-model use, or data boundaries are safe.
• Before enabling remote MCP/API access, a new export profile, or cloud model/embedding calls on a vault that holds sensitive or regulated content.
• After adding or changing skills, agent instructions, ingestion pipelines, or CI automation that touch raw sources, indexes, or writes.
• The user wants a prioritized, severity-ranked list of security findings and concrete mitigations rather than a from-scratch threat model (use llm-wiki-threat-model for that instead).

Inputs

• Vault/repository path.
• Agent instructions and installed skills.
• Capture pipelines and ingestion configs.
• Raw/wiki/index/export/tracing layout.
• MCP/API server configuration if present.
• Model/provider policy if available.
• CI, CODEOWNERS and branch protection configuration.
• Desired mode: report-only, patch recommendations or repo updates.

Procedure

1. Map trust boundaries

Identify:

• external sources and capture channels;
• parser/OCR/conversion jobs;
• local files and raw sources;
• generated wiki pages and review state;
• FTS/vector/graph indexes;
• retrieval and context packing;
• installed skills and agent instructions;
• external model, embedding and reranker calls;
• MCP/API servers and tools;
• CI/workflow automation;
• team permissions and branch controls;
• traces, logs, eval artifacts and published/exported outputs.

2. Review data classification

Classify content as:

public | internal | sensitive | regulated | unknown