1metadata:
2 id: ATR-AI-AGENT-CAPABILITY-CATALOG
3 type: CapabilityCatalog
4 gemara-version: "1.1.0"
5 version: "0.1.0"
6 description: >
7 Capabilities of AI agent systems that create the opportunity for the
8 threats catalogued by Agent Threat Rules (ATR). Each capability describes
9 a feature or function an agent can perform, not a threat. Threats reference
10 these capabilities; ATR detection rule categories map to them in a companion
11 MappingDocument. Authored by the ATR project and validated against the
12 Gemara schemas; ATR hosts the content, Gemara defines the schema.
13 author:
14 id: atr
15 name: Adam Lin
16 type: Human
17 contact:
18 name: Adam Lin
19 affiliation: Agent Threat Rules
20 email: adam@agentthreatrule.org
21 social: eeee2345
22
23title: AI Agent Capability Catalog
24
25groups:
26 - id: model-interaction
27 title: Model Interaction
28 description: >
29 Capabilities by which an agent receives instructions and untrusted
30 content into a language model and acts on the model's output.
31 - id: tool-and-protocol
32 title: Tool and Protocol Access
33 description: >
34 Capabilities by which an agent invokes external tools and connects to
35 tool servers over protocols such as the Model Context Protocol (MCP).
36 - id: extensibility
37 title: Extensibility
38 description: >
39 Capabilities by which an agent loads and runs third-party extensions
40 such as skills, plugins, and packaged capability bundles.
41 - id: state-and-memory
42 title: State and Memory
43 description: >
44 Capabilities by which an agent reads and writes persistent state,
45 conversation context, and long-term memory across turns and sessions.
46 - id: autonomy-and-coordination
47 title: Autonomy and Coordination
48 description: >
49 Capabilities by which an agent acts without per-step human approval and
50 coordinates with other agents.
51
52capabilities:
53 - id: CAP-MODEL-INFERENCE
54 title: Model Inference on Untrusted Input
55 description: >
56 The agent passes user instructions and content drawn from external
57 sources into a language model and treats the resulting output as
58 actionable. Mixing trusted instructions with untrusted content in a
59 single context window is the feature that makes prompt injection and
60 jailbreak attempts possible.
61 group: model-interaction
62
63 - id: CAP-OUTPUT-ACTION
64 title: Acting on Model Output
65 description: >
66 The agent converts model output into actions, tool calls, or content
67 returned to downstream systems. Because output is consumed without an
68 independent trust boundary, manipulated output can redirect behaviour
69 or carry exfiltrated data.
70 group: model-interaction
71
72 - id: CAP-TOOL-INVOCATION
73 title: Tool Invocation
74 description: >
75 The agent calls external tools and functions, passing arguments and
76 receiving results that re-enter the model context. Tool arguments and
77 tool results are an attack surface for injection, command execution,
78 and over-broad actions.
79 group: tool-and-protocol
80
81 - id: CAP-MCP-CONNECTION
82 title: MCP and Tool-Server Connection
83 description: >
84 The agent connects to tool servers over the Model Context Protocol or
85 similar transports, consuming server-provided tool manifests, schemas,
86 and descriptions. Server-controlled metadata is trusted at connection
87 time, which creates the opportunity for tool poisoning and tool
88 redefinition (rug-pull) after initial approval.
89 group: tool-and-protocol
90
91 - id: CAP-CROSS-AGENT-MESSAGING
92 title: Cross-Agent Message Passing
93 description: >
94 The agent sends and receives messages to and from other agents in a
95 multi-agent workflow. Messages from peer agents are treated as
96 trusted input, which lets a compromised or manipulated agent influence
97 others.
98 group: tool-and-protocol
99
100 - id: CAP-SKILL-LOADING
101 title: Skill and Plugin Loading
102 description: >
103 The agent loads third-party skills, plugins, or capability bundles and
104 executes the instructions and code they contain. Loaded extensions run
105 with the agent's privileges, which creates the opportunity for supply
106 chain compromise and backdoored or over-privileged skills.
107 group: extensibility
108
109 - id: CAP-MEMORY-WRITE
110 title: Memory and State Write
111 description: >
112 The agent writes facts, instructions, or artifacts into persistent
113 memory or shared state that influences later turns and sessions.
114 Writable memory is the feature that lets poisoned content persist and
115 take effect after the originating input is gone.
116 group: state-and-memory
117
118 - id: CAP-MEMORY-READ
119 title: Context and Memory Read
120 description: >
121 The agent reads conversation history, retrieved documents, and
122 long-term memory back into the active context. Reading attacker-
123 influenced state re-introduces untrusted content and is a channel for
124 indirect injection and staged data exfiltration.
125 group: state-and-memory
126
127 - id: CAP-AUTONOMOUS-ACTION
128 title: Autonomous Action Without Per-Step Approval
129 description: >
130 The agent executes multi-step plans, loops, and side-effecting actions
131 without human approval at each step. Unbounded autonomy is the feature
132 that turns a single manipulated decision into runaway loops, resource
133 abuse, or unauthorized real-world actions.
134 group: autonomy-and-coordination
135
136 - id: CAP-PRIVILEGED-EXECUTION
137 title: Privileged and Delegated Execution
138 description: >
139 The agent runs with delegated credentials and access to systems,
140 databases, files, and networks. Holding standing privilege creates the
141 opportunity for privilege escalation, sandbox escape, and use of the
142 agent's access beyond its intended scope.
143 group: autonomy-and-coordination