metadata:
  id: ATR-AI-AGENT-CAPABILITY-CATALOG
  type: CapabilityCatalog
  gemara-version: "1.1.0"
  version: "0.1.0"
  description: >
    Capabilities of AI agent systems that create the opportunity for the
    threats catalogued by Agent Threat Rules (ATR). Each capability describes
    a feature or function an agent can perform, not a threat. Threats reference
    these capabilities; ATR detection rule categories map to them in a companion
    MappingDocument. Authored by the ATR project and validated against the
    Gemara schemas; ATR hosts the content, Gemara defines the schema.
  author:
    id: atr
    name: Adam Lin
    type: Human
    contact:
      name: Adam Lin
      affiliation: Agent Threat Rules
      email: adam@agentthreatrule.org
      social: eeee2345

title: AI Agent Capability Catalog

groups:
  - id: model-interaction
    title: Model Interaction
    description: >
      Capabilities by which an agent receives instructions and untrusted
      content into a language model and acts on the model's output.
  - id: tool-and-protocol
    title: Tool and Protocol Access
    description: >
      Capabilities by which an agent invokes external tools and connects to
      tool servers over protocols such as the Model Context Protocol (MCP).
  - id: extensibility
    title: Extensibility
    description: >
      Capabilities by which an agent loads and runs third-party extensions
      such as skills, plugins, and packaged capability bundles.
  - id: state-and-memory
    title: State and Memory
    description: >
      Capabilities by which an agent reads and writes persistent state,
      conversation context, and long-term memory across turns and sessions.
  - id: autonomy-and-coordination
    title: Autonomy and Coordination
    description: >
      Capabilities by which an agent acts without per-step human approval and
      coordinates with other agents.

capabilities:
  - id: CAP-MODEL-INFERENCE
    title: Model Inference on Untrusted Input
    description: >
      The agent passes user instructions and content drawn from external
      sources into a language model and treats the resulting output as
      actionable. Mixing trusted instructions with untrusted content in a
      single context window is the feature that makes prompt injection and
      jailbreak attempts possible.
    group: model-interaction

  - id: CAP-OUTPUT-ACTION
    title: Acting on Model Output
    description: >
      The agent converts model output into actions, tool calls, or content
      returned to downstream systems. Because output is consumed without an
      independent trust boundary, manipulated output can redirect behaviour
      or carry exfiltrated data.
    group: model-interaction

  - id: CAP-TOOL-INVOCATION
    title: Tool Invocation
    description: >
      The agent calls external tools and functions, passing arguments and
      receiving results that re-enter the model context. Tool arguments and
      tool results are an attack surface for injection, command execution,
      and over-broad actions.
    group: tool-and-protocol

  - id: CAP-MCP-CONNECTION
    title: MCP and Tool-Server Connection
    description: >
      The agent connects to tool servers over the Model Context Protocol or
      similar transports, consuming server-provided tool manifests, schemas,
      and descriptions. Server-controlled metadata is trusted at connection
      time, which creates the opportunity for tool poisoning and tool
      redefinition (rug-pull) after initial approval.
    group: tool-and-protocol

  - id: CAP-CROSS-AGENT-MESSAGING
    title: Cross-Agent Message Passing
    description: >
      The agent sends and receives messages to and from other agents in a
      multi-agent workflow. Messages from peer agents are treated as
      trusted input, which lets a compromised or manipulated agent influence
      others.
    group: tool-and-protocol

  - id: CAP-SKILL-LOADING
    title: Skill and Plugin Loading
    description: >
      The agent loads third-party skills, plugins, or capability bundles and
      executes the instructions and code they contain. Loaded extensions run
      with the agent's privileges, which creates the opportunity for supply
      chain compromise and backdoored or over-privileged skills.
    group: extensibility

  - id: CAP-MEMORY-WRITE
    title: Memory and State Write
    description: >
      The agent writes facts, instructions, or artifacts into persistent
      memory or shared state that influences later turns and sessions.
      Writable memory is the feature that lets poisoned content persist and
      take effect after the originating input is gone.
    group: state-and-memory

  - id: CAP-MEMORY-READ
    title: Context and Memory Read
    description: >
      The agent reads conversation history, retrieved documents, and
      long-term memory back into the active context. Reading attacker-
      influenced state re-introduces untrusted content and is a channel for
      indirect injection and staged data exfiltration.
    group: state-and-memory

  - id: CAP-AUTONOMOUS-ACTION
    title: Autonomous Action Without Per-Step Approval
    description: >
      The agent executes multi-step plans, loops, and side-effecting actions
      without human approval at each step. Unbounded autonomy is the feature
      that turns a single manipulated decision into runaway loops, resource
      abuse, or unauthorized real-world actions.
    group: autonomy-and-coordination

  - id: CAP-PRIVILEGED-EXECUTION
    title: Privileged and Delegated Execution
    description: >
      The agent runs with delegated credentials and access to systems,
      databases, files, and networks. Holding standing privilege creates the
      opportunity for privilege escalation, sandbox escape, and use of the
      agent's access beyond its intended scope.
    group: autonomy-and-coordination