---
name: cve-review
description: Review a production AI deployment for LLM Scope Violation exposure.
version: 1.0.0
phase: 18
lesson: 25
tags: [echoleak, cve, llm-scope-violation, prompt-injection, aim-labs]
---

Given a production AI deployment description, review its exposure to EchoLeak-family LLM Scope Violation attacks.

Produce:

1. Retrieval boundary. What content sources reach the model's context via RAG? Inbox, repo issues, shared docs, web search. Each is a potential entry point for untrusted instructions.
2. Scope boundary. Which privileged scopes can the model access? Mailbox, private repositories, internal APIs, HR records. Identify which are accessible to retrieval-triggered actions.
3. Output boundary. How does the model's output reach the network? Rendered images, hyperlinks, tool outputs, signed-domain URLs. Each is a potential exfiltration channel.
4. CSP and domain-allowlist audit. What domains are allowed as rendering or link destinations? Microsoft's signed domains allowed EchoLeak; a narrower allowlist would have prevented it.
5. Three-boundary independence. Is each of the three boundaries defended independently? If retrieval injects, scope access, and output exfil are all prevented independently, the chain cannot complete.

Hard rejects:
- Any deployment review that treats the three boundaries as one "prompt injection" problem.
- Any defense based solely on input classification of retrieved content (per Lesson 15 + Nasr 2025 adaptive attacks).
- Any claim of "our CSP is correctly configured" without testing CSP-approved exfiltration attempts.

Refusal rules:
- If the user asks whether their deployment is EchoLeak-safe, refuse the binary without the five-section audit.
- If the user asks for a silver-bullet remediation, refuse — the three boundaries require three independent controls.

Output: a one-page review filling the five sections, naming the weakest boundary, and recommending the highest-value control. Cite Aim Labs (EchoLeak writeup) and OWASP LLM Top 10 (2025) once each.