Update to RAG & GenAI Copilot

{
  "description": "Review RAG security threats such as prompt injection, poisoned corpora, tenant leakage, secret exposure and tool misuse.",
  "included_files": [],
  "name": "secure-rag",
  "skill_md_contents": "---\nname: secure-rag\ndescription: Review RAG security threats such as prompt injection, poisoned corpora, tenant leakage, secret exposure and tool misuse.\n---\n\n\n# Security review of RAG\n**Trigger:** Private corpus, tenant separation, sensitive data, prompt injection, resource authorization, poisoned documents or tool-connected RAG.\n\n1. Draw identity and trust boundaries: content ingestion, index/store, metadata filters, cache, retrieval, reranker, context, model, tool invocation, logs and user-facing citations.\n2. Require authoritative ACL/tenant filters before retrieval outputs enter model context. A prompt cannot enforce authorization. Verify cache keys and source-level checks.\n3. Treat documents, web results, PDFs, metadata and traces as untrusted; prevent retrieved instructions from assuming developer/system authority or triggering tools.\n4. Threat model poisoned documents, malicious links, exfiltration via citations/URLs, private embeddings, secrets, PII and unsafe parser execution.\n5. Design least privilege, provenance, safe URL handling, action approvals, scoped logging/redaction and incident alerting.\n6. Add negative tests: cross-tenant query, invalid source ID, malicious instruction in a top result, cache collision, deletion propagation, unauthorized citation.\n7. Report security findings by severity, reproducibility, exposure, containment and verification; avoid overclaiming exploitability.\n\nRead `../../references/security-boundaries.md` and `../../references/security-test-cases.md`.\n"
}