docs: consolidate vulnerabilities and threat profiles into one section

[Nicola Franco (franconicola)]

Summary

• Previously the docs had two parallel, overlapping sidebar entries: Vulnerabilities (13 pages) and Threat Profiles (13 pages), duplicating most of the same information.
• Vulnerabilities is now a single sidebar entry — a folder containing one page per vulnerability class, and each page now includes its threat profile (objective, primary/secondary datasets, primary/secondary attack techniques, metrics) inline, plus a profile-driven "Run an Evaluation Campaign" example.
• The general threat-profile concepts (profile anatomy, relevance levels, objectives) moved into the Vulnerabilities overview page; the "creating a custom threat profile" reference moved into Custom Vulnerabilities, next to where custom vulnerabilities are already documented.
• Deleted the standalone threat-profiles.md page and threat-profiles/ folder (14 files) and updated every cross-reference and the sidebar config accordingly.

Closes #517

Test plan

• npx docusaurus build completes successfully with no broken-link warnings
• Verified no remaining references to threat-profiles anywhere in docs/

[Copilot]

Pull request overview

This PR restructures the Docusaurus documentation by consolidating “Threat Profiles” content into the “Vulnerabilities” section, aiming to remove duplication and make each vulnerability page self-contained.

Changes:

• Replaces the separate “Threat Profiles” sidebar section with a single “Vulnerabilities” category containing one page per vulnerability.
• Moves threat-profile concepts/anatomy into risks/vulnerabilities.md and updates cross-links across the risks docs.
• Deletes the standalone threat-profiles.md and per-profile pages, and adds “Run an Evaluation Campaign” examples to vulnerability pages.

Reviewed changes

Copilot reviewed 34 out of 34 changed files in this pull request and generated 15 comments.

Show a summary per file

File	Description
docs/sidebars.ts	Updates sidebar structure to remove “Threat Profiles” and nest vulnerability pages under “Vulnerabilities”.
docs/docs/risks/vulnerabilities.md	Moves threat-profile conceptual docs into the Vulnerabilities overview page and updates “Learn more” links.
docs/docs/risks/custom-vulnerabilities.md	Updates custom vulnerability docs to include threat-profile creation guidance and helper references.
docs/docs/risks/risk-categories.mdx	Updates “Next steps” links to point at Vulnerabilities instead of Threat Profiles.
docs/docs/risks/index.mdx	Updates Risks overview links and wording to reflect the new documentation structure.
docs/docs/risks/evaluation-campaigns.md	Updates “Learn more” links to remove Threat Profiles.
docs/docs/risks/evaluation-campaigns/custom-campaigns.md	Replaces Threat Profiles link with Vulnerabilities link.
docs/docs/risks/vulnerabilities/jailbreak.md	Converts threat profile content into the vulnerability page and adds a profile-driven campaign example.
docs/docs/risks/vulnerabilities/prompt-injection.md	Converts threat profile content into the vulnerability page and adds a profile-driven campaign example.
docs/docs/risks/vulnerabilities/system-prompt-leakage.md	Converts threat profile content into the vulnerability page and adds a profile-driven campaign example.
docs/docs/risks/vulnerabilities/input-manipulation-attack.md	Converts threat profile content into the vulnerability page and adds a profile-driven campaign example.
docs/docs/risks/vulnerabilities/model-evasion.md	Converts threat profile content into the vulnerability page and adds a profile-driven campaign example.
docs/docs/risks/vulnerabilities/craft-adversarial-data.md	Converts threat profile content into the vulnerability page and adds a profile-driven campaign example.
docs/docs/risks/vulnerabilities/sensitive-information-disclosure.md	Converts threat profile content into the vulnerability page and adds a profile-driven campaign example.
docs/docs/risks/vulnerabilities/misinformation.md	Converts threat profile content into the vulnerability page and adds a profile-driven campaign example.
docs/docs/risks/vulnerabilities/excessive-agency.md	Converts threat profile content into the vulnerability page and adds a profile-driven campaign example.
docs/docs/risks/vulnerabilities/malicious-tool-invocation.md	Converts threat profile content into the vulnerability page and adds a profile-driven campaign example.
docs/docs/risks/vulnerabilities/credential-exposure.md	Converts threat profile content into the vulnerability page and adds a custom-goals campaign example.
docs/docs/risks/vulnerabilities/public-facing-application-exploitation.md	Converts threat profile content into the vulnerability page and adds a profile-driven campaign example.
docs/docs/risks/vulnerabilities/vector-embedding-weaknesses-exploit.md	Converts threat profile content into the vulnerability page and adds a profile-driven campaign example.
docs/docs/risks/threat-profiles.md	Deletes the standalone Threat Profiles overview page.
docs/docs/risks/threat-profiles/jailbreak.md	Deletes standalone threat profile page (content migrated).
docs/docs/risks/threat-profiles/prompt-injection.md	Deletes standalone threat profile page (content migrated).
docs/docs/risks/threat-profiles/system-prompt-leakage.md	Deletes standalone threat profile page (content migrated).
docs/docs/risks/threat-profiles/input-manipulation-attack.md	Deletes standalone threat profile page (content migrated).
docs/docs/risks/threat-profiles/model-evasion.md	Deletes standalone threat profile page (content migrated).
docs/docs/risks/threat-profiles/craft-adversarial-data.md	Deletes standalone threat profile page (content migrated).
docs/docs/risks/threat-profiles/sensitive-information-disclosure.md	Deletes standalone threat profile page (content migrated).
docs/docs/risks/threat-profiles/misinformation.md	Deletes standalone threat profile page (content migrated).
docs/docs/risks/threat-profiles/excessive-agency.md	Deletes standalone threat profile page (content migrated).
docs/docs/risks/threat-profiles/malicious-tool-invocation.md	Deletes standalone threat profile page (content migrated).
docs/docs/risks/threat-profiles/credential-exposure.md	Deletes standalone threat profile page (content migrated).
docs/docs/risks/threat-profiles/public-facing-application-exploitation.md	Deletes standalone threat profile page (content migrated).
docs/docs/risks/threat-profiles/vector-embedding-weaknesses-exploit.md	Deletes standalone threat profile page (content migrated).

Comments suppressed due to low confidence (5)

docs/docs/risks/custom-vulnerabilities.md:125

• This should use STATIC_TEMPLATE_ONLY to match hackagent.risks.profile_helpers (the constant used by built-in profiles) rather than the non-existent STATIC_TEMPLATE_ATTACKS.

    attacks=STATIC_TEMPLATE_ATTACKS,

docs/docs/risks/custom-vulnerabilities.md:145

• profile_helpers exports STATIC_TEMPLATE_ONLY, not STATIC_TEMPLATE_ATTACKS. The docs' helper import list should match the actual API so readers can copy/paste it.

    STATIC_TEMPLATE_ATTACKS,  # Static Template-only attack list

docs/docs/risks/custom-vulnerabilities.md:168

• This bullet refers to STATIC_TEMPLATE_ATTACKS, but the helper constant is named STATIC_TEMPLATE_ONLY in hackagent.risks.profile_helpers.

- **STATIC_TEMPLATE_ATTACKS** — Simple direct testing, no adversarial optimization

docs/docs/risks/vulnerabilities/jailbreak.md:76

• HackAgent.hack() expects snake_case attack_type keys like static_template. Lowercasing StaticTemplate produces statictemplate, which is not a supported strategy key.

            "attack_type": attack.technique.lower(),

docs/docs/risks/vulnerabilities/input-manipulation-attack.md:68

• HackAgent.hack() expects snake_case attack_type keys like static_template. Lowercasing StaticTemplate produces statictemplate, which is not a supported strategy key.

            "attack_type": attack.technique.lower(),

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

Copilot reviewed 34 out of 34 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (2)

docs/docs/risks/vulnerabilities/prompt-injection.md:50

• The Threat Profile section lists RAG Attack as a PRIMARY technique, but PROMPT_INJECTION_PROFILE in code uses JAILBREAK_ATTACKS (StaticTemplate, PAIR, AdvPrefix) and does not include the rag technique. This makes the profile documentation inconsistent with the actual profile constant that the page’s code example imports.

- **Static Template**: Template-based prompt injection
- **PAIR**: Iterative refinement for bypass discovery
- **RAG Attack**: Indirect Injection through document poisoning in RAG pipelines

docs/docs/risks/vulnerabilities.md:120

• The example output for JAILBREAK_PROFILE.attack_techniques is incorrect. JAILBREAK_PROFILE defines attacks ["h4rm3l", "TAP", "PAIR"] (see hackagent/risks/jailbreak/profile.py), so this comment will mislead users copying the snippet.

# ['StaticTemplate', 'PAIR', 'AdvPrefix']

[Copilot]

Pull request overview

Copilot reviewed 34 out of 34 changed files in this pull request and generated 1 comment.