/maestro

name: maestro
description: >-
  Run a MAESTRO threat model — the Cloud Security Alliance's layered framework
  for multi-agent / agentic AI systems — enumerating threats at each layer of the
  agent stack and across agent-to-agent and cross-layer trust boundaries. Use when
  threat modeling a multi-agent or agentic AI system where agent-to-agent trust,
  orchestration logic, and delegated tool use matter more than a single data flow.

Goal

A MAESTRO-layered threat analysis for a multi-agent/agentic system: the agent stack decomposed into layers, cross-layer and cross-agent trust breaks enumerated, and each mapped to a mitigation.

Why MAESTRO, and when

STRIDE and PASTA are asset/data-flow-centric — excellent for a single system with a clear DFD. Agentic systems add a different threat surface: autonomous agents delegating to sub-agents, orchestrators trusting sub-agent output, tools/MCP servers returning content that itself becomes an instruction, and emergent behavior from agent-to-agent interaction that no single data flow captures. MAESTRO (CSA, "Agentic AI Threat Modeling Framework: MAESTRO") decomposes the agentic stack into layers and asks what can go wrong *at* each layer and *across* layer/agent boundaries — complementary to, not a replacement for, STRIDE/PASTA.

• **Single-agent, simple system** → `stride` is enough.
• **Multi-agent, orchestrated, or tool/MCP-delegating system** → run MAESTRO

alongside STRIDE; MAESTRO catches the cross-layer/cross-agent breaks STRIDE's per-element pass tends to miss.

• **GenAI feature generally** (RAG, single LLM call, etc.) → see

`llm-security:ai-threat-model` for the OWASP LLM Top 10 overlay; that skill points back here for the multi-agent case.

The layers (working model — see Notes)

1. **Foundation Models** — the model(s) themselves: training/fine-tune provenance, model-level vulnerabilities, jailbreak/alignment weaknesses. 2. **Data Operations** — data ingestion, RAG stores, embeddings, memory: provenance, poisoning, cross-tenant leakage. 3. **Agent Frameworks / Orchestration** — the orchestration logic, planning loops, inter-agent messaging: how one agent's output becomes another's input. 4. **Deployment & Infrastructure** — runtime, network exposure, secrets/identity the agents run under, sandboxing of tool execution. 5. **Evaluation & Observability** — monitoring, logging, eval harnesses: can an agent's misbehavior actually be detected, and can logs be trusted/tampered? 6. **Security & Compliance** — the controls layered on top (authz, guardrails, policy enforcement) and whether they apply consistently across agents. 7. **Agent Ecosystem** — the multi-agent system as a whole: agent-to-agent trust, delegation chains, third-party/external agents, and emergent behavior from their interaction.

Steps

1. **Map the agents and their layer placement.** Identify every agent/sub-agent, what it's built on (layer 1), what data/memory it touches (layer 2), how it's orchestrated and what it messages to/from (layer 3), where it runs (layer 4). 2. **Per layer, enumerate trusted vs. untrusted.** What enters and leaves each layer, and is it treated as trusted instruction or untrusted content? 3. **Focus on cross-layer and cross-agent breaks.** The highest-value threats are boundary crossings: a compromised or manipulated sub-agent's output flowing untrusted into an orchestrator's decision layer; a tool/MCP result silently treated as trusted instruction; an eval/observability gap that lets layer-3 misbehavior go undetected. Walk every agent-to-agent and agent-to-tool edge explicitly — don't stop at per-layer analysis alone. 4. **Rank** with `threat-modeling:risk-rank` (likelihood × impact). 5. **Map mitigations** per threat, noting existing controls vs. gaps — for tool/MCP-boundary specifics, hand off to `agentic-ai-security:mcp-security-review` and `agentic-ai-security:agent-security-review`.

Output

A layer-by-layer threat table (layer · element/edge · threat · risk · mitigation · status) plus a short "top cross-layer/cross-agent risks" summary. Hand to `security-reporting` if a formal document is needed.

Notes

The 7-layer breakdown above is this skill's working model of MAESTRO based on CSA's publicly described framework — cite CSA's published MAESTRO documentation for the canonical, current layer names/count rather than treating the numbering here as a fixed standard; the framework has evolved since its initial publication. What matters operationally is the discipline: decompose the agent stack into layers, then hunt specifically for trust breaks *between* layers and *between* agents, which per-DFD STRIDE passes systematically under-weight. Use standalone for a pure agentic-architecture review, or alongside `llm-security:ai-threat-model` when the system is also GenAI/LLM-specific.