# Gen Ai Security

> >-

- **Type:** Skill
- **Install:** `agentstack add skill-kyleoliveiro-sg-gov-skills-gen-ai-security`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [kyleoliveiro](https://agentstack.voostack.com/s/kyleoliveiro)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [kyleoliveiro](https://github.com/kyleoliveiro)
- **Source:** https://github.com/kyleoliveiro/sg-gov-skills/tree/main/skills/gen-ai-security

## Install

```sh
agentstack add skill-kyleoliveiro-sg-gov-skills-gen-ai-security
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# gen-ai-security: GA controls for SG government GenAI features

You are building or auditing a **Generative AI feature** against the ICT&SS Policy Reform
**Gen-AI SSP overlay**: the **8 GA controls (GA-1..GA-8) plus DP-8** — nine controls in
total. The family's scope is *securing the use of GenAI models and applications*: where the
model runs, what data may reach it, the provenance of self-hosted weights, input
safeguards, output evaluation, and user awareness. Most of these are decisions you bake in
on day one, and exactly what an audit or VAPT of a GenAI service walks through.

The single decision everything hangs on: **the maximum data classification the feature
handles determines which model/provider you may call.** Get that boundary right first; the
rest follows.

## What this family is *not* about

The GA controls are about **data-classification governance, provider agreements, weight
provenance, input safeguards, output evaluation, and user awareness** — not primarily about
prompt-engineering defenses. Two things people wrongly expect here:

- **Prompt injection / jailbreak defense** has no separately named GA control. It is tested
  under **GA-7 (safety)** and fixed as **Application Security (secure-coding-as)**. Cover
  it — but don't cite a non-existent "GA prompt-injection control."
- **The provider API key** is an application secret (**AS-8**, secure-coding-as), not GA-3.
  GA-3 governs the provider's *contract*, not how you store the key.

## Source and currency

Control text in this skill and `references/ga-controls.md` is embedded from
**info.standards.tech.gov.sg as of 2026-07-22**; the pages were last updated **24 March
2026**. The standards iterate actively. For any compliance-critical decision, verify
against the live pages:

- GA control catalog: https://info.standards.tech.gov.sg/control-catalog/cybersecurity/ga/
- Gen-AI SSP overlay: https://info.standards.tech.gov.sg/ssp/gen-ai/

## Reference files

- `references/ga-controls.md` — full text of all 8 GA controls + DP-8 (statement,
  recommendations, risk, the two GA-5 parameters), data-classification background, and
  cross-family notes. Read it when you need exact wording, e.g. for an audit response or
  SSP documentation.
- `references/implementation-recipes.md` — concrete, framework-neutral code and config per
  control: provider-routing by classification, the GA-3 agreement checklist, safetensors /
  approved-loader loading, file-upload safeguards, DP-8 input disclosure, the GA-7 eval
  harness, and the GA-8 acknowledgment gate. Read it when actually building.

## Before you start: find the SSP and the data classification

Two inputs gate everything. Get them before writing code; if either is missing, flag it
first rather than guessing.

**1. The maximum data classification** the feature will process (confirm with the data
owner). This sets the GA-1/GA-2 routing ceiling. Don't assume "it's just a chatbot, it's
low-risk" — a public assistant that can be fed CONFIDENTIAL case data is a CONFIDENTIAL
system.

**2. The System Security Plan (SSP)** selects which controls apply at which level and sets
parameter values. GA-5 carries **two agency-defined parameters** the catalog leaves blank:

| Control | Parameter | What the SSP defines |
|---|---|---|
| GA-5 | ga-5_prm_1 | The approved model **formats** for open-weights models (e.g. safetensors) |
| GA-5 | ga-5_prm_2 | The approved model **loaders** for open-weights models |

**Ask for the SSP's values; do not invent an approved-format or approved-loader list.** If
no SSP exists yet, flag that — the sibling skill **ssp-navigator** determines whether the
Gen-AI overlay applies and at which level each GA control sits for this system. GA-5's
parameters only matter if you **self-host open-weights models**; a pure API integration can
mark GA-5 not-applicable (and should say why).

## Procedure

Work in this order. For **setup**, apply each step. For **audit**, verify each and record
pass / fail / not-applicable-per-SSP with evidence (the route config, the signed agreement,
the loader version, the eval report, the UI screenshot). Recipes for every step are in
`references/implementation-recipes.md`.

### Stage 1 — Decide where the model runs (GA-1, GA-2, GA-3, GA-4)

**1a. Route by data classification (GA-1/GA-2).** Overseas-hosted GenAI APIs may process
only up to **RESTRICTED / SENSITIVE NORMAL**; Singapore-hosted only up to **CONFIDENTIAL /
SENSITIVE HIGH**. Make this a code invariant: tag each call site with the max classification
it can carry and refuse to dispatch above the route's ceiling — don't leave it to a comment
or a wiki page. Watch the **cross-region trap**: an "SG region" endpoint that can fail over
or infer overseas counts as overseas (GA-1) for classification.

**1b. Get the no-log/no-train agreement (GA-3).** You need a **legally-binding** provider
commitment: no logging, storage, or retention of inputs/outputs, and no training on them —
covering **all endpoints, parameters, outputs, and models** you call. Prompt caching is
allowed only if **TTL ≤ 24 hours**. **GCC 2.0 GenAI API services satisfy GA-3** — prefer
them and you skip the bespoke agreement; for any other provider, the signed agreement is
the audit evidence.

**1c. Clear the environment for self-hosted models (GA-4).** If you self-host, the serving
environment must be authorized for the **highest data classification** in the system it
serves (per the relevant IM8 SSP for that classification). Self-hosting in a container
brings the **Container Security** family in for the image and cluster — pair with the
container-security skill.

### Stage 2 — Secure the weight supply chain (GA-5)

Open-weights only. The risk is **arbitrary code execution at load time**. Use an approved
**format** (ga-5_prm_1 — commonly **safetensors**, a non-executable tensor container) and
never `torch.load` an untrusted pickle checkpoint (`.bin`/`.pt`/`.ckpt`), which executes
code while deserializing. Load via an approved, **frequently updated** loader (ga-5_prm_2) —
loader CVEs are the attack path; pin by version/digest and take reviewed bumps. Pull weights
from a trusted, access-controlled source and verify checksums.

### Stage 3 — Guard the inputs (GA-6, DP-8)

**3a. File-upload safeguards (GA-6)** — only if uploads are enabled. **Disable bulk/batch
uploads**, require **per-file classification confirmation** (rejecting anything above the
route ceiling), run **DLP** on extracted text before it reaches the prompt, and validate
type/size. Treat extracted document text as untrusted (indirect prompt injection — test
under GA-7).

**3b. Classification disclosure at input fields (DP-8).** Show the maximum permitted
classification **at or near every input field** that reaches the model (and in the user
guide), kept in sync with the actual route. Visible, not buried in help.

### Stage 4 — Evaluate outputs (GA-7)

Build an **evaluation harness** with defined **metrics, test scenarios, and criteria**
across three axes: **accuracy** (task correctness, RAG groundedness), **safety** (refusals,
PII leakage, and prompt-injection/jailbreak resistance — direct and indirect), and
**quality** (format, tone, no fabricated citations). Run it as a **gate that re-runs after
every model or prompt change**, document the approach, and store results per model version
to catch regressions. This is where prompt injection gets tested — it has no separate
control.

### Stage 5 — Inform users (GA-8)

Require an **explicit acknowledgment** of hallucination risk (a checkbox or "I Agree")
**before** the app can be used — gate on it **server-side**, not just in the UI. Add a
**risk clause in the Terms of Use**, a **prominent persistent indicator** that outputs are
AI-generated, and **educational material** on responsible use.

## Audit checklist

Verify each row; record evidence. "Param" marks the control whose pass criteria come from
the SSP. GA-4/GA-5 apply only when self-hosting open-weights models — mark
not-applicable-per-SSP with a reason otherwise.

| ID | Check | Where | Param |
|---|---|---|---|
| GA-1 | Overseas GenAI API only sends ≤ RESTRICTED/SENSITIVE NORMAL; enforced in code, not prose | Routing/dispatch code | |
| GA-2 | SG-hosted GenAI API only sends ≤ CONFIDENTIAL/SENSITIVE HIGH; cross-region processing checked | Routing/dispatch code | |
| GA-3 | Legally-binding no-log/no-train agreement covering all endpoints; cache TTL ≤ 24h; or GCC 2.0 | Contract / provider config | |
| GA-4 | Self-hosted model environment authorized for the system's highest data classification | Hosting env / SSP | |
| GA-5 | Open-weights loaded from an approved format (safetensors) via an approved, updated loader; no pickle | Model-loading code | ✓ |
| GA-6 | Bulk uploads disabled; per-file classification confirm; DLP on extracted text; type/size validation | Upload handler | |
| DP-8 | Max permitted classification shown at/near every model input field and in the guide | UI + user guide | |
| GA-7 | Defined accuracy/safety/quality metrics + scenarios; safety incl. prompt-injection; gates on model change | Eval harness / CI | |
| GA-8 | Explicit hallucination acknowledgment before access (server-enforced); ToU clause; prominent AI indicator | UI + ToU | |

Report per control ID with pass / fail / not-applicable-per-SSP, the evidence found, and —
for failures — the fix from `references/implementation-recipes.md`. Where a pass depends on
the SSP (GA-5 formats/loaders), ask for the SSP value rather than inventing one.

## Related skills in this repo

- **ssp-navigator** — decides *whether* the Gen-AI overlay applies and at which level each
  GA control sits (and where GA-1/GA-2 gate on data classification). Use it before declaring
  any GA control in or out of scope; this skill implements what it selects.
- **secure-coding-as** — Application Security (AS) + Crypto/Key Management (CK): where the
  **provider API key (AS-8)** lives, and where **prompt-injection fixes** land as input
  handling and least-privilege tool design once GA-7 testing surfaces them.
- **container-security** — CS controls for a **self-hosted model's serving image and
  cluster**; pair with GA-4 when you host open-weights models in containers.
- **secure-pipeline** — SD + SC: the GA-5 loader is a pinned dependency (SC-4) and the eval
  harness is a required CI check (SD-3); wire GA-7 into the pipeline gate there.
- **data-protection** — the DP family this overlay leans on: **DP-8** classification
  disclosure (Stage 3), plus the residency and encryption constraints DP imposes on the
  data that GA-1/GA-2 routing (decided by maximum data classification) lets reach a model.
- **security-testing** — ST controls for the GenAI VAPT: the security-relevant findings
  from GA-7 (prompt injection, unsafe or data-leaking output) feed the vulnerability
  programme and its remediation SLAs (ST-5) — accuracy/quality regressions stay in GA-7.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [kyleoliveiro](https://github.com/kyleoliveiro)
- **Source:** [kyleoliveiro/sg-gov-skills](https://github.com/kyleoliveiro/sg-gov-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-kyleoliveiro-sg-gov-skills-gen-ai-security
- Seller: https://agentstack.voostack.com/s/kyleoliveiro
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.