# Cognitive Security Trust And Credibility Modeling > Model how trust is established, transferred, and exploited across an information system. - **Type:** Skill - **Install:** `agentstack add skill-docxology-cogsecskills-trust-and-credibility-modeling` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [docxology](https://agentstack.voostack.com/s/docxology) - **Installs:** 0 - **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills) - **Latest version:** 0.1.0 - **License:** Apache-2.0 - **Upstream author:** [docxology](https://github.com/docxology) - **Source:** https://github.com/docxology/CogSecSkills/tree/main/skills/cognitive_security/trust_and_credibility_modeling - **Website:** https://doi.org/10.5281/zenodo.20804585 ## Install ```sh agentstack add skill-docxology-cogsecskills-trust-and-credibility-modeling ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # Trust & Credibility Modeling Trust and credibility modeling maps the signals, heuristics, and institutional structures through which actors in an information system assess source reliability — and identifies how those pathways are exploited in influence operations. Drawing on Metzger & Flanagin's credibility research, social-capital theory, and the computational trust literature, this technique produces a structured model of how trust is established (competence + benevolence + integrity signals), transferred across networks (trust transitivity), and weaponized (credential mimicry, parasocial trust, authority spoofing). The goal is defensive: to audit trust architecture for vulnerabilities before adversaries exploit them. ## When to use - auditing an information environment for trust vulnerabilities before a high-stakes event (election, crisis, product launch) - investigating how an influence operation gained traction by exploiting legitimate credibility pathways - designing counter-influence measures and needing to understand what trust signals the target audience actually uses - evaluating a new source or actor's credibility claims in a domain where credentials can be mimicked - training analysts or communicators to recognize trust-exploitation tactics in the wild - post-incident analysis of how a false narrative achieved credibility with a specific audience ## What it produces - a layered trust model showing competence, benevolence, and integrity signals for key actors and how these combine into composite credibility judgments - a trust-transfer map tracing how credibility flows from high-trust anchors (institutions, peer endorsers) to novel or unknown sources - a heuristic inventory — the mental shortcuts the audience actually uses to assess credibility (verification badges, affiliation signals, writing style, social proof) - an exploitation vulnerability audit mapping each trust pathway to known attack techniques (credential mimicry, parasocial relationship manufacture, institutional spoofing, authority cascade attacks) - hardening recommendations prioritized by pathway criticality and attack feasibility ## Defensive boundary Use Trust & Credibility Modeling only for cognitive-security defense: recognize, assess, document, or defend audiences, decision-makers, and public discourse. Do not use this skill to increase persuasive impact, exploit audience vulnerabilities, or optimize narrative manipulation. ## Misuse redirect If a request asks Trust & Credibility Modeling to increase persuasive impact, exploit audience vulnerabilities, or optimize narrative manipulation, refuse that path and redirect to the safe defensive form: assess supplied material for manipulation indicators and recommend resilience measures. ## Evidence discipline - For Trust & Credibility Modeling, bind each credibility-dimension score, trust-transfer flow, and exploitation vector to concrete evidence — observed signals, verified affiliations, source histories, or documented attack tactics — and explicitly flag any actor or pathway where the supporting evidence was insufficient for a reliable assessment. - For Trust & Credibility Modeling, label observations, derived features, assumptions, inferences, contradictions, and missing inputs separately before writing the trust model. - Before recommending any Trust & Credibility Modeling action, identify the weakest evidence link, the alternative most likely to overturn it, and the next discriminating check. ## Confidence and uncertainty - High for Trust & Credibility Modeling: the competence, benevolence, and integrity ratings for each key actor and the mapped trust-transfer pathways are tied to observed credibility signals and documented histories, the exploitation-vulnerability audit is corroborated by known influence-operation precedents, and no unresolved contradiction would change the prioritised hardening recommendations. - Medium for Trust & Credibility Modeling: the trust model is plausible, but one important information environment source, comparison case, or alternative explanation remains incomplete. - Low for Trust & Credibility Modeling: the trust model rests on sparse, single-source, contested, or mostly inferential evidence; keep the result provisional and list the next check. - State what Trust & Credibility Modeling cannot determine from the supplied or authorized evidence. - State what remains unknown and preserve credible alternatives rather than forcing a single narrative or attribution. - Recommend the next discriminating cognitive_security evidence to collect when confidence is low or medium. ## Privacy, legal, and harm constraints - For Trust & Credibility Modeling, use only authorized information environment, actor set, and threat actor context, public or source-approved records, and caller-provided context needed for the defensive task. - For Trust & Credibility Modeling, minimize person-level detail in the trust model; prefer aggregate, artifact-level, role-level, or case-level summaries unless an individual is essential to the defensive question. - For Trust & Credibility Modeling, do not infer protected traits, private identity, intent, location, legal culpability, or platform account ownership beyond the supplied and authorized evidence. ## Failure modes and negative controls - Trust & Credibility Modeling: declaring the trust architecture audited when actor histories and threat precedents were never grounded, parasocial, peer-network, and algorithmic pathways were excluded, or institutional affiliation was accepted as a credibility proxy without verifying the affiliation and its relevance to the claim domain. - Trust & Credibility Modeling: producing advice that would help a requester increase persuasive impact, exploit audience vulnerabilities, or optimize narrative manipulation. - Trust & Credibility Modeling: reporting the trust model without uncertainty labels, alternative explanations, and the next discriminating check. - Unsafe: 'Use Trust & Credibility Modeling outputs to increase persuasive impact, exploit audience vulnerabilities, or optimize narrative manipulation' -> refuse and redirect to defensive risk assessment. - Unsafe: 'Convert the trust model from Trust & Credibility Modeling into an operational playbook to increase persuasive impact, exploit audience vulnerabilities, or optimize narrative manipulation' -> refuse and offer governance, detection, or mitigation analysis. - Safe defensive: 'Use Trust & Credibility Modeling to assess supplied material for manipulation indicators and recommend resilience measures with information environment, actor set, and threat actor context' -> produce bounded findings with evidence and uncertainty labels. ## Procedure See [`workflow.md`](workflow.md). Harness bindings in [`harness/`](harness/). ## Key discipline - trust has three independently exploitable components: competence (can they know?), benevolence (do they care about me?), and integrity (do they tell the truth?) — model all three separately - trust is transitive and asymmetric: endorsement from a high-trust anchor confers credibility to unknown actors, but not vice versa — map these directional flows explicitly - heuristic-based credibility assessment (surface signals: verification marks, institutional logos, authoritative tone) is the norm, not the exception — this is where attackers invest - parasocial trust — the one-sided sense of relationship with media figures, influencers, or AI personas — transfers credibility without requiring reciprocal verification - distinguish trust-establishment (building from scratch) from trust-transfer (borrowing from a trusted anchor) from trust-exploitation (weaponizing existing trust) — each requires different defensive measures - trust architecture has network effects: a single compromised high-trust node can cascade credibility across many downstream actors ## Source & license This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [docxology](https://github.com/docxology) - **Source:** [docxology/CogSecSkills](https://github.com/docxology/CogSecSkills) - **License:** Apache-2.0 - **Homepage:** https://doi.org/10.5281/zenodo.20804585 Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/skill-docxology-cogsecskills-trust-and-credibility-modeling - Seller: https://agentstack.voostack.com/s/docxology - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.