51 lines
2.8 KiB
JSON
51 lines
2.8 KiB
JSON
{
|
|
"schema_version": "t3mp3st_demo_missions/v1",
|
|
"missions": [
|
|
{
|
|
"id": "owned-local-web-api",
|
|
"label": "Owned Local Web/API",
|
|
"family": "web_api",
|
|
"target": "http://127.0.0.1:3333",
|
|
"directive": "We own this local API. Map the exposed surface, identify the highest-impact web and API risks, preserve evidence, avoid production writes, and produce an engineering fix plan.",
|
|
"safe_first_moves": ["preflight", "sync arsenal", "plan tools", "log evidence", "mission gate"],
|
|
"expected_outputs": ["route preview", "tool plan", "evidence item", "finding", "retest", "mission bundle"]
|
|
},
|
|
{
|
|
"id": "repo-supply-chain-hardening",
|
|
"label": "Repository Supply Chain Hardening",
|
|
"family": "code_supply_chain",
|
|
"target": ".",
|
|
"directive": "Review this local repository for dependency, secret, CI/CD, release, and provenance risk. Do not expose secret values. Produce prioritized fixes and acceptance tests.",
|
|
"safe_first_moves": ["preflight", "activation", "plan tools", "log evidence", "review run"],
|
|
"expected_outputs": ["repo trust map", "dependency triage", "secret redaction check", "fix plan", "memory proposal"]
|
|
},
|
|
{
|
|
"id": "ai-agent-boundary-probe",
|
|
"label": "AI Agent Boundary Probe",
|
|
"family": "ai_red_team",
|
|
"target": "local-agent-fixture",
|
|
"directive": "Test a local AI agent boundary for prompt, tool, memory, and browser authority failures. Use synthetic hostile content, preserve transcripts as evidence, and map findings to defensive controls.",
|
|
"safe_first_moves": ["preflight", "guided start", "plan tools", "log evidence", "bundle"],
|
|
"expected_outputs": ["boundary map", "prompt eval plan", "transcript evidence", "control recommendations"]
|
|
},
|
|
{
|
|
"id": "smart-contract-local-fixture",
|
|
"label": "Smart Contract Local Fixture",
|
|
"family": "smart_contract",
|
|
"target": "contracts/",
|
|
"directive": "Analyze local smart-contract artifacts for static, property, fuzz, and dry-run risks. Stay local unless a scoped testnet receipt is provided.",
|
|
"safe_first_moves": ["sync arsenal", "activation", "plan tools", "log evidence"],
|
|
"expected_outputs": ["static findings", "property-test plan", "dry-run gate", "fix acceptance criteria"]
|
|
},
|
|
{
|
|
"id": "leadership-risk-brief",
|
|
"label": "Leadership Risk Brief",
|
|
"family": "reporting_remediation",
|
|
"target": "current-mission-ledger",
|
|
"directive": "Turn the current evidence and findings into a plain-English risk brief with bottom line, scope, top risks, owners, next actions, and retest acceptance criteria.",
|
|
"safe_first_moves": ["bundle", "gate", "review run"],
|
|
"expected_outputs": ["executive summary", "owner/action table", "evidence appendix", "retest plan"]
|
|
}
|
|
]
|
|
}
|