Copy this prompt into the AI assistant you're using.
Follow https://skillsmp.com/skill-install/prompt.md to install Agent Skills from https://github.com/elementalsouls/Claude-AgentHunter.Loading the repository README…
Showing 24 of 24 collected skills.
Master orchestrator for AI-agent red-team assessments — enterprise copilots, DevOps/SRE agents, RAG assistants, coding/IDE agents, MCP/A2A tool servers, autonomous workflow agents. Load at the START of any agent test, when facing a new agent target, or when…
Cross-cutting techniques for getting a payload past input/output guardrails — safety classifiers, refusal training, moderation filters, DLP. Encoding/obfuscation, Unicode-tag/ASCII smuggling, low-resource-language, adversarial suffixes (GCG), payload…
Trust/supply-chain attacks on the MCP tool ecosystem an agent connects to — tool-description injection, rug-pull (tool mutates after approval), cross-server tool shadowing, line-jumping/name collision, confused-deputy via a malicious tool, token/consent…
Persistent poisoning of an AI agent's long-term memory / stored profile / writable knowledge — so injected content survives across sessions (and sometimes across users) and re-fires without re-injection. Covers direct memory-write injection, indirect…
Command/code injection in AI-agent tools — shell, Python/JS eval, SQL, SSRF via fetch tools. Covers separators, the newline bypass and the shell-vs-agent-extraction ambiguity that decides whether substitution fires, denylist bypass, the exit-code oracle, and…
Authorization bypass in AI-agent tools — role/persona claims, unverifiable named-credential exceptions, privilege fields inside attacker-supplied credential documents, privilege escalation via prompt injection, data-classification override, and…
Attacks specific to computer-use and browser agents — agents that see a screen/DOM and act by clicking, typing, and navigating (AI browsers like Comet/Atlas, ChatGPT Operator, Claude Computer-Use, RPA copilots). Covers indirect injection through rendered page…
MCP (Model Context Protocol) exposure in AI agents: direct resource access, tool enumeration, missing auth, session/Origin issues, protocol-level abuse, and the delegated-identity OAuth flows an MCP proxy runs — confused-deputy auth-code theft, token…
Cross-agent trust, privilege, and shared-state abuse in multi-agent systems, including A2A (Agent-to-Agent) protocol exposure. Confused-deputy across agents, privileged-tool reach via a 'clearance'/orchestrator agent, direct A2A/agent-card access, indirect…
Client-side data exfiltration through AI-agent OUTPUT rendered in a UI — zero-click markdown-image exfil, HTML/img-src injection, one-click hyperlink exfil, and CSP/allowlist bypass. The agent is induced (usually via prompt injection) to emit markup that the…
Prompt injection in AI agents — direct (chat box is the trust boundary), indirect (payload planted in data the agent later reads: docs, web pages, emails/tickets, RAG chunks, tool output), multimodal (image/audio/file, ASCII/Unicode-tag smuggling), and…
Extract data from AI-agent tools that execute but hide output — status-only, exit-code-only, or DLP-filtered. Characterize FIRST (visibility, allowlist, egress), then pick a channel: OOB DNS/HTTP, DLP-bypass via an unfiltered tool, boolean exit-code oracle,…
Brute-force and rate-limiting weaknesses in AI-agent tools — PIN/token/password guessing with no lockout, and feedback oracles (correct-digit / too-high-low / Mastermind-style) that collapse the search space. Use when a tool accepts guesses and returns…
The agent's OWN configuration, instruction, and settings files as an attack surface — CLAUDE.md / AGENTS.md / .cursorrules / copilot-instructions.md, .vscode/settings.json, .claude/settings.json, .cursor/mcp.json / .mcp.json, hooks, and allowlist/YOLO…
Cryptographic weaknesses in AI-agent tools that encrypt/decrypt/sign or mint tokens — ECB cut-and-paste and byte-at-a-time, padding oracles, missing MAC, hardcoded keys/predictable IVs. Use when an agent exposes crypto operations as tools.
Unsafe deserialization in AI-agent tools that parse structured data — YAML, pickle, JSON, XML, TOML — via tool parameters, AND poisoned model/dataset artifacts loaded from a hub (Hugging Face / registry pickle: torch.load, .pkl/.pt/.ckpt). Identify the…
Defeating the human-in-the-loop approval gate — the last line of defense before a consequential agent action (payment, deploy, delete, email, privilege grant). Approval-summary manipulation (approve X, agent does Y), approval fatigue/batching, standing…
Information disclosure in AI-agent tools — log/diagnostic leakage, environment dumps via multi-step diagnostic chains, path traversal, arbitrary file import, and secret-in-context. Every tool that returns data is a potential leak; a returned 'secret' may be…
Memory-safety exploitation of the NATIVE program behind an agent tool — stack/heap overflow, pointer and length-field corruption, leaked addresses in tool output, and ret2shellcode/ROP through an MCP or function-calling interface. Use when a tool wraps a…
Extract an AI agent's system prompt, tool contract, hidden instructions, and embedded secrets — and tell a real leak from a confabulation. Structural extraction (quote-the-Nth-sentence), guardrail-vs-filter distinction, and the run-twice reproducibility gate.…
TOCTOU / race conditions in AI-agent tools: double-spend, limit bypass, coupon reuse, privilege flip, inventory oversell — any stateful agent where check and commit aren't atomic. Fire operations in parallel (single-packet beats an LLM 'do it simultaneously'…
Attacks on retrieval-augmented agents and their vector stores — knowledge/corpus poisoning, indirect injection via retrieved chunks, cross-tenant/access-control retrieval bypass (IDOR at the embedding layer), ranking manipulation, embedding…
Unbounded-consumption / denial-of-wallet attacks on agents — forcing expensive token generation, recursive/agent-fan-out loops, unbounded context/retrieval, costly downstream tool calls, and shared-quota exhaustion that degrades service for other tenants. The…
Temporal-constraint bypass in AI-agent tools — future-dating, weekend/maintenance-window evasion, rate-reset manipulation. Time gates enforced as prompt instructions are not real time locks. A TOCTOU variant: cross-check hunt-agent-race-condition before…
Repository README source: README.md
Read the source README