ai-security

Use when attacking an AI/ML system or model — prompt injection & jailbreaks (Crescendo, Skeleton Key, Best-of-N), RAG/vector poisoning, agentic/MCP exploitation (CVE-2025-54136), ML supply-chain RCE (pickle CVE-2025-32434), model extraction / membership inference / adversarial suffixes (GCG)

Jump to install

Repository: hypnguyen1209/offensive-claude
Last source activity: June 29, 2026 at 07:22
Detected SKILL.md language: English
Stars: 343
Forks: 59

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill ai-security

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

11 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

AI/ML Security

When to Activate

Red-teaming an LLM/chatbot/copilot for direct & indirect prompt injection and multi-turn jailbreaks.

Testing a RAG pipeline for document/embedding poisoning, embedding inversion, and cross-tenant retrieval leakage.

Auditing an AI agent / MCP server for tool poisoning, excessive agency, and command injection (RCE).

Scanning a model artifact (HuggingFace, .pt/.pkl/.bin/.gguf) for deserialization payloads before loading it.

Assessing a model API for extraction/distillation, membership inference, and adversarial-suffix robustness.

Mapping findings to OWASP LLM Top-10 (2025) + MITRE ATLAS for a report.

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Direct prompt injection / system-prompt leak (LLM01/LLM07)

T1059.006, T1606

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Multi-turn jailbreak: Crescendo / Skeleton Key

T1059.006

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Best-of-N / many-shot / token-smuggling jailbreak

T1059.006, T1027

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Indirect injection via ingested content (EchoLeak CVE-2025-32711)

T1190, T1059.006

CWE-74

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

RAG knowledge-base poisoning (PoisonedRAG, 5 docs)

T1195, T1565.001

CWE-349

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

Embedding-collision / RAG-spraying retrieval hijack

T1195.001

CWE-349

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

Embedding inversion (reconstruct input from vectors)

T1552, T1213

CWE-202

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

MCP tool poisoning / rug-pull (CVE-2025-54136/54135)

T1195.001, T1059.006

CWE-74

references/agentic-mcp-exploitation.md

AI/ML Security

When to Activate

Red-teaming an LLM/chatbot/copilot for direct & indirect prompt injection and multi-turn jailbreaks.

Testing a RAG pipeline for document/embedding poisoning, embedding inversion, and cross-tenant retrieval leakage.

Auditing an AI agent / MCP server for tool poisoning, excessive agency, and command injection (RCE).

Scanning a model artifact (HuggingFace, .pt/.pkl/.bin/.gguf) for deserialization payloads before loading it.

Assessing a model API for extraction/distillation, membership inference, and adversarial-suffix robustness.

Mapping findings to OWASP LLM Top-10 (2025) + MITRE ATLAS for a report.

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Direct prompt injection / system-prompt leak (LLM01/LLM07)

T1059.006, T1606

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Multi-turn jailbreak: Crescendo / Skeleton Key

T1059.006

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Best-of-N / many-shot / token-smuggling jailbreak

T1059.006, T1027

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Indirect injection via ingested content (EchoLeak CVE-2025-32711)

T1190, T1059.006

CWE-74

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

RAG knowledge-base poisoning (PoisonedRAG, 5 docs)

T1195, T1565.001

CWE-349

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

Embedding-collision / RAG-spraying retrieval hijack

T1195.001

CWE-349

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

Embedding inversion (reconstruct input from vectors)

T1552, T1213

CWE-202

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

MCP tool poisoning / rug-pull (CVE-2025-54136/54135)

T1195.001, T1059.006

CWE-74

references/agentic-mcp-exploitation.md

Technique

Telemetry / IOC

Detection (Sigma/EDR)

OPSEC note

Direct injection / jailbreak

High-entropy/odd prompts in app & gateway logs; refusal→compliance flip

Prompt-firewall (Llama Prompt Guard, Azure XPIA); per-turn + trajectory classifier; flag "ignore previous", DAN, base64 blobs

Throttle, rotate sessions/keys; many free probes are heavily logged & fingerprinted

Multi-turn (Crescendo/Skeleton Key)

Benign→escalating topic drift across turns; conversation reframing safety rules

Trajectory-aware monitor scoring whole conversation, not single turn

Spread across turns/sessions; per-turn filters miss it but stateful monitors don't

Indirect injection (EchoLeak-class)

LLM follows instructions from retrieved doc/email/page; outbound auto-fetch (img/markdown) to new host

DLP on AI egress; CSP/allowlist on auto-fetch; XPIA classifier on retrieved context

Payload lives in data, not the chat; hidden via HTML comment/white text — but egress is the IOC

RAG poisoning

Anomalous high-similarity doc dominating retrieval; ingest from untrusted source

Provenance tags per chunk; retrieval-anomaly + RevPRAG activation analysis (98% TPR)

Needs write access to the KB/ingest path; doc itself is the durable IOC

MCP tool poisoning / RCE

Tool description carrying imperative text; child_process.exec/shell metachars; tool-def mutation post-install

Pin & hash tool manifests; alert on dynamic re-registration; execFile not exec; gateway audit

Rug-pull = quiet; manifest hash drift and the spawned shell are the tells

Malicious model load

REDUCE/GLOBAL opcodes invoking os/posix/pip/runpy; child proc from python during torch.load

fickling/modelscan/picklescan ≥0.0.22 pre-load scan; EDR: python→cmd/curl spawn; prefer safetensors

Scanning is local & safe; loading an untrusted pickle is the dangerous act — scan first, never load to "test"

Model extraction / MIA

Sustained diverse high-volume API queries; logprob requests; near-duplicate prompt sweeps

Per-key rate/anomaly limits; disable/clip logprobs; output watermarking; query-similarity clustering

Distribute over keys/IPs/time; logprob access dramatically lowers query budget — watch for it being disabled

Adversarial suffix (GCG)

Garbled/high-perplexity suffix tokens appended to prompts

Perplexity filter on input; paraphrase/retokenize defense

White-box GCG needs weights; transfer suffixes are noisy & perplexity-detectable

name	ai-security
description	Use when attacking an AI/ML system or model — prompt injection & jailbreaks (Crescendo, Skeleton Key, Best-of-N), RAG/vector poisoning, agentic/MCP exploitation (CVE-2025-54136), ML supply-chain RCE (pickle CVE-2025-32434), model extraction / membership inference / adversarial suffixes (GCG)
metadata	{"type":"offensive","phase":"analysis","tools":"garak, PyRIT, promptfoo, fickling, modelscan, picklescan, safetensors, sentence-transformers, transformers, vllm, mcp-inspector, nuclei","mitre":"TA0043"}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0001","TA0002","TA0009","TA0040"],"attck_techniques":["T1190","T1059","T1059.006","T1195","T1195.001","T1195.002","T1059.004","T1606","T1552","T1213","T1657","T1499"]}
depends_on	["recon-osint"]
feeds_into	["exploit-development","web-pentest","cloud-security"]
inputs	["ai_model_endpoint","rag_pipeline","mcp_server","model_artifact","agent_tool_schema"]
outputs	["finding_record","adversarial_payload","poisoned_document","malicious_model","surrogate_model"]
references	["references/prompt-injection-jailbreak.md","references/rag-vector-poisoning.md","references/agentic-mcp-exploitation.md","references/ml-supply-chain.md","references/model-extraction-adversarial.md"]
scripts	["scripts/promptinject_harness.py","scripts/rag_poisoner.py","scripts/mcp_tool_audit.py","scripts/model_scan.py","scripts/model_extractor.py"]

name	ai-security
description	Use when attacking an AI/ML system or model — prompt injection & jailbreaks (Crescendo, Skeleton Key, Best-of-N), RAG/vector poisoning, agentic/MCP exploitation (CVE-2025-54136), ML supply-chain RCE (pickle CVE-2025-32434), model extraction / membership inference / adversarial suffixes (GCG)
metadata	{"type":"offensive","phase":"analysis","tools":"garak, PyRIT, promptfoo, fickling, modelscan, picklescan, safetensors, sentence-transformers, transformers, vllm, mcp-inspector, nuclei","mitre":"TA0043"}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0001","TA0002","TA0009","TA0040"],"attck_techniques":["T1190","T1059","T1059.006","T1195","T1195.001","T1195.002","T1059.004","T1606","T1552","T1213","T1657","T1499"]}
depends_on	["recon-osint"]
feeds_into	["exploit-development","web-pentest","cloud-security"]
inputs	["ai_model_endpoint","rag_pipeline","mcp_server","model_artifact","agent_tool_schema"]
outputs	["finding_record","adversarial_payload","poisoned_document","malicious_model","surrogate_model"]
references	["references/prompt-injection-jailbreak.md","references/rag-vector-poisoning.md","references/agentic-mcp-exploitation.md","references/ml-supply-chain.md","references/model-extraction-adversarial.md"]
scripts	["scripts/promptinject_harness.py","scripts/rag_poisoner.py","scripts/mcp_tool_audit.py","scripts/model_scan.py","scripts/model_extractor.py"]

ai-security

Install options

Review the source files

AI/ML Security

When to Activate

Technique Map

AI/ML Security

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

ai-security

Source facts

Install options

Review the source files

More from this repository

More from this repository

AI/ML Security

When to Activate

Technique Map

AI/ML Security

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives