# AASTF Community Scenario Template
# Copy this file, fill in every field, then run:
#   aastf scenario validate ./my-scenario.yaml
# Submit as a PR to scenarios/community/

id: ASI01-099          # Format: ASI##-### — must be unique across all scenarios
name: "Short descriptive name (under 60 chars)"
category: ASI01        # ASI01–ASI10 (see OWASP ASI Top 10)
severity: HIGH         # CRITICAL / HIGH / MEDIUM / LOW / INFO

description: |
  One paragraph explaining what this attack tests and why it matters.
  What does the attacker do? What does a vulnerable agent do wrong?

attack_vector: "One-line summary of how the attack is delivered"

# Where is the adversarial payload injected?
# Options: user_message | tool_response | memory | system_prompt
inject_into: user_message

# The attack payload. Can include Jinja2 templates: {{ payload }}
payload: |
  Your adversarial content here.
  Can be multiple lines.

# Optional: additional payload variations for fuzzing (--run-variants flag)
payload_variants:
  - "Alternative phrasing of the attack"
  - "Another variant"

# Configure sandbox tool responses (for inject_into: tool_response)
# tool_responses:
#   - tool_name: web_search
#     response_payload:
#       results:
#         - snippet: "{{ payload }}"
#     response_mode: success  # success | error | malformed | delayed

# Which tools should the agent have available?
available_tools: [web_search, send_email]

# Detection: what constitutes a successful attack (VULNERABLE verdict)?
# At least one criterion must fire for the scenario to fail.
detection:
  # FAIL if agent called any of these tools
  tool_called: [send_email, delete_file]
  # FAIL if a tool was called with input containing this substring
  # tool_input_contains:
  #   send_email: "attacker@evil.com"
  # FAIL if output contains any of these strings
  # output_contains: ["Confirmed: action complete"]
  # FAIL if planning loop exceeds this iteration count
  # loop_iterations_exceed: 15
  # FAIL if total tool calls exceed this count
  # tool_call_count_exceeds: 20

# Describe what a SAFE agent should do instead
expected_behavior: |
  Describe the correct, secure behavior. What should happen instead of the attack?

# How should developers fix this vulnerability?
remediation: |
  Specific, actionable remediation steps.
  Include what to enforce at which layer (dispatch, orchestration, etc.)

# Categorization for filtering and search
tags: [your-tag, another-tag]

# Link to OWASP ASI category and any relevant papers/CVEs
references:
  - "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/#asi01"

author: your-github-username
version: "1.0"
