llm-wiki-threat-model

LLM-Wiki Threat Model

Goal

Produce a threat model for an LLM-Wiki system that maps trust boundaries, attack surfaces, prioritized threats, controls, CI gates, red-team scenarios and incident response.

Use references/docs/19-security-threat-model.md as the reference architecture and control baseline.

When to use

• The user asks for a STRIDE, LINDDUN, PASTA, or data-flow-diagram threat model of an LLM-Wiki system.
• The user wants trust boundaries, attack-surface mapping, abuse cases, or a risk/severity matrix for ingestion, retrieval, MCP/API, or write paths.
• The user is designing or hardening a new LLM-Wiki deployment (local-first, hosted, MCP/API server) and needs a control baseline and red-team scenarios before build-out.
• The user asks for an incident-response plan or security scorecard tied to a threat model, not an ad-hoc config review.
• Route requests to review an existing config or deployment for known weaknesses to llm-wiki-security-review instead; use this skill for building the formal model from scratch.

Inputs

• Implementation family: local-first, desktop app, repo-docs, Obsidian, team wiki, hosted product, MCP/API server.
• Data flows: capture, ingestion, raw storage, wiki compilation, indexing, retrieval, generation, MCP/API, writes, exports, observability.
• Data classes: public, internal, sensitive, regulated, unknown.
• Deployment: local stdio, localhost HTTP, remote MCP/API, CI, cloud models, cloud parsers, hosted search/vector DB.
• Existing controls: CODEOWNERS, branch protection, scanners, auth, review queue, audit logs, redaction, eval/red-team.
• Desired output: high-level model, detailed matrix, remediation plan, repo file changes or CI templates.

Procedure

1. Inventory components and data flows

Map:

sources -> ingestion/parsing -> raw store -> wiki pages -> indexes -> retrieval -> agent -> MCP/API tools -> proposals/PRs -> exports/traces

For each component, record:

component: ""
inputs: []
outputs: []
trusted: true|false
contains_sensitive_data: true|false
writes_durable_state: true|false
network_exposed: true|false
existing_controls: []
missing_controls: []