ai-agent-redteam

Use when red-teaming an agentic AI / LLM application — indirect & zero-click prompt injection, MCP tool poisoning, persistent memory poisoning, excessive-agency tool abuse, multi-turn jailbreaks, PyRIT/Garak/Promptfoo harnesses

Jump to install

Repository: hypnguyen1209/offensive-claude
Last source activity: June 29, 2026 at 07:22
Detected SKILL.md language: English
Stars: 343
Forks: 59

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill ai-agent-redteam

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

13 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

reverse-engineering

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

2026-07-30

privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

2026-06-30

threat-model-discipline

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing

2026-06-30

View all from this repository

AI Agent Red Teaming

Offensive testing of autonomous LLM agents — systems that combine model reasoning with tools, memory, retrieval, and multi-step planning. This is distinct from model-level testing (see ai-security): the attack surface here is the agentic pipeline — untrusted data channels, tool/MCP integrations, persistent memory, and delegated authority. Assumes authorized engagement.

When to Activate

Pentesting an LLM agent with tool/function-calling, an MCP client, or a code interpreter

Testing RAG / email / browser assistants for indirect or zero-click prompt injection

Auditing MCP server integrations for tool poisoning, rug-pull, or line-jumping

Assessing persistent memory / long-term context for poisoning and belief drift

Evaluating excessive agency: confused-deputy, SSRF/RCE-via-tool, over-privileged actions

Running automated jailbreak campaigns (PAIR/TAP/Crescendo/Best-of-N) and measuring ASR

Standing up a repeatable PyRIT/Garak/Promptfoo harness mapped to OWASP Agentic Top 10 / ATLAS

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Indirect / zero-click prompt injection (EchoLeak-class)

T1566.002 / AML.T0051.001

CWE-1427

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

RAG corpus poisoning & markdown/image exfiltration

T1567 / AML.T0070

CWE-1426

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

Browser-agent hijack (Comet/CometJacking, Atlas)

T1071.001 / AML.T0051

CWE-1427

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

MCP tool poisoning / line-jumping

T1059 / AML.T0053

CWE-1427

references/mcp-tool-poisoning.md

scripts/mcp_tool_poison_server.py

MCP rug-pull (silent redefinition)

T1554 / AML.T0010

CWE-494

references/mcp-tool-poisoning.md

scripts/mcp_tool_poison_server.py

Persistent memory poisoning (MINJA/MemoryGraft)

T1565.001 / AML.T0070

CWE-349

references/memory-context-poisoning.md

scripts/memory_poison_minja.py

AI Agent Red Teaming

When to Activate

Pentesting an LLM agent with tool/function-calling, an MCP client, or a code interpreter

Testing RAG / email / browser assistants for indirect or zero-click prompt injection

Auditing MCP server integrations for tool poisoning, rug-pull, or line-jumping

Assessing persistent memory / long-term context for poisoning and belief drift

Evaluating excessive agency: confused-deputy, SSRF/RCE-via-tool, over-privileged actions

Running automated jailbreak campaigns (PAIR/TAP/Crescendo/Best-of-N) and measuring ASR

Standing up a repeatable PyRIT/Garak/Promptfoo harness mapped to OWASP Agentic Top 10 / ATLAS

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Indirect / zero-click prompt injection (EchoLeak-class)

T1566.002 / AML.T0051.001

CWE-1427

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

RAG corpus poisoning & markdown/image exfiltration

T1567 / AML.T0070

CWE-1426

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

Browser-agent hijack (Comet/CometJacking, Atlas)

T1071.001 / AML.T0051

CWE-1427

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

MCP tool poisoning / line-jumping

T1059 / AML.T0053

CWE-1427

references/mcp-tool-poisoning.md

scripts/mcp_tool_poison_server.py

MCP rug-pull (silent redefinition)

T1554 / AML.T0010

CWE-494

references/mcp-tool-poisoning.md

scripts/mcp_tool_poison_server.py

Persistent memory poisoning (MINJA/MemoryGraft)

T1565.001 / AML.T0070

CWE-349

references/memory-context-poisoning.md

scripts/memory_poison_minja.py

name	ai-agent-redteam
description	Use when red-teaming an agentic AI / LLM application — indirect & zero-click prompt injection, MCP tool poisoning, persistent memory poisoning, excessive-agency tool abuse, multi-turn jailbreaks, PyRIT/Garak/Promptfoo harnesses
metadata	{"type":"offensive","phase":"exploit","tools":["pyrit","garak","promptfoo","python","mcp"],"mitre":["AML.T0051","AML.T0053","AML.T0054","AML.T0070","AML.T0071"]}
kill_chain	{"phase":["recon","weaponize","delivery","exploit","actions"],"step":[1,2,3,4,7],"attck_tactics":["TA0043","TA0001","TA0002","TA0010"],"attck_techniques":["T1566.002","T1059","T1071.001","T1567","T1657"]}
depends_on	["recon-osint","ai-security"]
feeds_into	["exploit-development","cloud-security","web-pentest"]
inputs	["agent_endpoint","mcp_server_config","rag_corpus","system_prompt","tool_manifest"]
outputs	["finding_record","jailbreak_payload","poisoned_artifact","attack_success_rate_report"]
references	["references/indirect-prompt-injection.md","references/mcp-tool-poisoning.md","references/memory-context-poisoning.md","references/excessive-agency-tool-abuse.md","references/automated-jailbreak-multiturn.md","references/agent-redteam-tooling.md"]
scripts	["scripts/indirect_injection_forge.py","scripts/mcp_tool_poison_server.py","scripts/memory_poison_minja.py","scripts/agency_tool_fuzzer.py","scripts/multiturn_jailbreak.py","scripts/agent_redteam_harness.py"]

name	ai-agent-redteam
description	Use when red-teaming an agentic AI / LLM application — indirect & zero-click prompt injection, MCP tool poisoning, persistent memory poisoning, excessive-agency tool abuse, multi-turn jailbreaks, PyRIT/Garak/Promptfoo harnesses
metadata	{"type":"offensive","phase":"exploit","tools":["pyrit","garak","promptfoo","python","mcp"],"mitre":["AML.T0051","AML.T0053","AML.T0054","AML.T0070","AML.T0071"]}
kill_chain	{"phase":["recon","weaponize","delivery","exploit","actions"],"step":[1,2,3,4,7],"attck_tactics":["TA0043","TA0001","TA0002","TA0010"],"attck_techniques":["T1566.002","T1059","T1071.001","T1567","T1657"]}
depends_on	["recon-osint","ai-security"]
feeds_into	["exploit-development","cloud-security","web-pentest"]
inputs	["agent_endpoint","mcp_server_config","rag_corpus","system_prompt","tool_manifest"]
outputs	["finding_record","jailbreak_payload","poisoned_artifact","attack_success_rate_report"]
references	["references/indirect-prompt-injection.md","references/mcp-tool-poisoning.md","references/memory-context-poisoning.md","references/excessive-agency-tool-abuse.md","references/automated-jailbreak-multiturn.md","references/agent-redteam-tooling.md"]
scripts	["scripts/indirect_injection_forge.py","scripts/mcp_tool_poison_server.py","scripts/memory_poison_minja.py","scripts/agency_tool_fuzzer.py","scripts/multiturn_jailbreak.py","scripts/agent_redteam_harness.py"]

Technique	Telemetry / IOC	Detection (Sigma/EDR)	OPSEC note
Indirect injection	Hidden HTML comment / white-on-white / 0px text in ingested docs; markdown image to external host	Scan ingested content for `<!--`, `display:none`, `font-size:0`, reference-style `![]`; alert on agent-initiated egress to non-allowlisted domains	Stage payloads only on assets in scope; use unique per-test OAST tokens to attribute hits
MCP tool poisoning	New/changed tool description hash; instruction-like text in JSON Schema `description`/`enum`	Diff tool manifests on connect; flag tool metadata containing imperative verbs / `<IMPORTANT>` / "do not tell the user"	Test against a local client; never point a real client at an untrusted server outside the lab
Memory poisoning	Memory write from low-trust source; semantic drift between stored belief and source provenance	Provenance-tagged memory; alert on retrieval that injects procedural instructions; belief-drift monitor	Use benign-looking triggers; document the latent trigger so blue team can replay/clean
Excessive agency	Tool call to internal IP / metadata endpoint; unusual tool-chain ordering; off-hours actions	EDR/network: egress to 169.254.169.254/link-local; anomaly on tool-call sequences	Use non-destructive canaries (read-only SSRF probe) before any state-changing test
Automated jailbreak	Burst of semantically-similar prompts; high-perplexity / encoded inputs; rising compliance over turns	Rate + similarity clustering per session; perplexity & encoding detectors; multi-turn escalation scoring	Throttle to avoid DoS; log full transcripts for the report; respect content guardrails of scope

ai-agent-redteam

Install options

Review the source files

AI Agent Red Teaming

When to Activate

Technique Map

AI Agent Red Teaming

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

ai-agent-redteam

Source facts

Install options

Review the source files

More from this repository

AI Agent Red Teaming

When to Activate

Technique Map

AI Agent Red Teaming

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

More from this repository