ai-security

Use when attacking an AI/ML system or model — prompt injection & jailbreaks (Crescendo, Skeleton Key, Best-of-N), RAG/vector poisoning, agentic/MCP exploitation (CVE-2025-54136), ML supply-chain RCE (pickle CVE-2025-32434), model extraction / membership inference / adversarial suffixes (GCG)

Zur Installation springen

Repository: hypnguyen1209/offensive-claude
Letzte Quellaktivität: 29. Juni 2026 um 07:22
Erkannte Sprache von SKILL.md: Englisch
Sterne: 343
Forks: 59

Installationsoptionen

Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill ai-security

Der Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.

Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.

Quelldateien prüfen

Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.

Datei-Explorer

11 Dateien

SKILL.md

Quellanweisungen · Schreibgeschützte Vorschau

Zurück zur Suche Zurück zur Installation

AI/ML Security

When to Activate

Red-teaming an LLM/chatbot/copilot for direct & indirect prompt injection and multi-turn jailbreaks.

Testing a RAG pipeline for document/embedding poisoning, embedding inversion, and cross-tenant retrieval leakage.

Auditing an AI agent / MCP server for tool poisoning, excessive agency, and command injection (RCE).

Scanning a model artifact (HuggingFace, .pt/.pkl/.bin/.gguf) for deserialization payloads before loading it.

Assessing a model API for extraction/distillation, membership inference, and adversarial-suffix robustness.

Mapping findings to OWASP LLM Top-10 (2025) + MITRE ATLAS for a report.

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Direct prompt injection / system-prompt leak (LLM01/LLM07)

T1059.006, T1606

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Multi-turn jailbreak: Crescendo / Skeleton Key

T1059.006

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Best-of-N / many-shot / token-smuggling jailbreak

T1059.006, T1027

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Indirect injection via ingested content (EchoLeak CVE-2025-32711)

T1190, T1059.006

CWE-74

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

RAG knowledge-base poisoning (PoisonedRAG, 5 docs)

T1195, T1565.001

CWE-349

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

Embedding-collision / RAG-spraying retrieval hijack

T1195.001

CWE-349

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

Embedding inversion (reconstruct input from vectors)

T1552, T1213

CWE-202

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

MCP tool poisoning / rug-pull (CVE-2025-54136/54135)

T1195.001, T1059.006

CWE-74

references/agentic-mcp-exploitation.md

AI/ML Security

When to Activate

Red-teaming an LLM/chatbot/copilot for direct & indirect prompt injection and multi-turn jailbreaks.

Testing a RAG pipeline for document/embedding poisoning, embedding inversion, and cross-tenant retrieval leakage.

Auditing an AI agent / MCP server for tool poisoning, excessive agency, and command injection (RCE).

Scanning a model artifact (HuggingFace, .pt/.pkl/.bin/.gguf) for deserialization payloads before loading it.

Assessing a model API for extraction/distillation, membership inference, and adversarial-suffix robustness.

Mapping findings to OWASP LLM Top-10 (2025) + MITRE ATLAS for a report.

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Direct prompt injection / system-prompt leak (LLM01/LLM07)

T1059.006, T1606

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Multi-turn jailbreak: Crescendo / Skeleton Key

T1059.006

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Best-of-N / many-shot / token-smuggling jailbreak

T1059.006, T1027

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Indirect injection via ingested content (EchoLeak CVE-2025-32711)

T1190, T1059.006

CWE-74

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

RAG knowledge-base poisoning (PoisonedRAG, 5 docs)

T1195, T1565.001

CWE-349

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

Embedding-collision / RAG-spraying retrieval hijack

T1195.001

CWE-349

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

Embedding inversion (reconstruct input from vectors)

T1552, T1213

CWE-202

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

MCP tool poisoning / rug-pull (CVE-2025-54136/54135)

T1195.001, T1059.006

CWE-74

references/agentic-mcp-exploitation.md

Technique

Telemetry / IOC

Detection (Sigma/EDR)

OPSEC note

Direct injection / jailbreak

High-entropy/odd prompts in app & gateway logs; refusal→compliance flip

Prompt-firewall (Llama Prompt Guard, Azure XPIA); per-turn + trajectory classifier; flag "ignore previous", DAN, base64 blobs

Throttle, rotate sessions/keys; many free probes are heavily logged & fingerprinted

Multi-turn (Crescendo/Skeleton Key)

Benign→escalating topic drift across turns; conversation reframing safety rules

Trajectory-aware monitor scoring whole conversation, not single turn

Spread across turns/sessions; per-turn filters miss it but stateful monitors don't

Indirect injection (EchoLeak-class)

LLM follows instructions from retrieved doc/email/page; outbound auto-fetch (img/markdown) to new host

DLP on AI egress; CSP/allowlist on auto-fetch; XPIA classifier on retrieved context

Payload lives in data, not the chat; hidden via HTML comment/white text — but egress is the IOC

RAG poisoning

Anomalous high-similarity doc dominating retrieval; ingest from untrusted source

Provenance tags per chunk; retrieval-anomaly + RevPRAG activation analysis (98% TPR)

Needs write access to the KB/ingest path; doc itself is the durable IOC

MCP tool poisoning / RCE

Tool description carrying imperative text; child_process.exec/shell metachars; tool-def mutation post-install

Pin & hash tool manifests; alert on dynamic re-registration; execFile not exec; gateway audit

Rug-pull = quiet; manifest hash drift and the spawned shell are the tells

Malicious model load

REDUCE/GLOBAL opcodes invoking os/posix/pip/runpy; child proc from python during torch.load

fickling/modelscan/picklescan ≥0.0.22 pre-load scan; EDR: python→cmd/curl spawn; prefer safetensors

Scanning is local & safe; loading an untrusted pickle is the dangerous act — scan first, never load to "test"

Model extraction / MIA

Sustained diverse high-volume API queries; logprob requests; near-duplicate prompt sweeps

Per-key rate/anomaly limits; disable/clip logprobs; output watermarking; query-similarity clustering

Distribute over keys/IPs/time; logprob access dramatically lowers query budget — watch for it being disabled

Adversarial suffix (GCG)

Garbled/high-perplexity suffix tokens appended to prompts

Perplexity filter on input; paraphrase/retokenize defense

White-box GCG needs weights; transfer suffixes are noisy & perplexity-detectable

name	ai-security
description	Use when attacking an AI/ML system or model — prompt injection & jailbreaks (Crescendo, Skeleton Key, Best-of-N), RAG/vector poisoning, agentic/MCP exploitation (CVE-2025-54136), ML supply-chain RCE (pickle CVE-2025-32434), model extraction / membership inference / adversarial suffixes (GCG)
metadata	{"type":"offensive","phase":"analysis","tools":"garak, PyRIT, promptfoo, fickling, modelscan, picklescan, safetensors, sentence-transformers, transformers, vllm, mcp-inspector, nuclei","mitre":"TA0043"}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0001","TA0002","TA0009","TA0040"],"attck_techniques":["T1190","T1059","T1059.006","T1195","T1195.001","T1195.002","T1059.004","T1606","T1552","T1213","T1657","T1499"]}
depends_on	["recon-osint"]
feeds_into	["exploit-development","web-pentest","cloud-security"]
inputs	["ai_model_endpoint","rag_pipeline","mcp_server","model_artifact","agent_tool_schema"]
outputs	["finding_record","adversarial_payload","poisoned_document","malicious_model","surrogate_model"]
references	["references/prompt-injection-jailbreak.md","references/rag-vector-poisoning.md","references/agentic-mcp-exploitation.md","references/ml-supply-chain.md","references/model-extraction-adversarial.md"]
scripts	["scripts/promptinject_harness.py","scripts/rag_poisoner.py","scripts/mcp_tool_audit.py","scripts/model_scan.py","scripts/model_extractor.py"]

name	ai-security
description	Use when attacking an AI/ML system or model — prompt injection & jailbreaks (Crescendo, Skeleton Key, Best-of-N), RAG/vector poisoning, agentic/MCP exploitation (CVE-2025-54136), ML supply-chain RCE (pickle CVE-2025-32434), model extraction / membership inference / adversarial suffixes (GCG)
metadata	{"type":"offensive","phase":"analysis","tools":"garak, PyRIT, promptfoo, fickling, modelscan, picklescan, safetensors, sentence-transformers, transformers, vllm, mcp-inspector, nuclei","mitre":"TA0043"}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0001","TA0002","TA0009","TA0040"],"attck_techniques":["T1190","T1059","T1059.006","T1195","T1195.001","T1195.002","T1059.004","T1606","T1552","T1213","T1657","T1499"]}
depends_on	["recon-osint"]
feeds_into	["exploit-development","web-pentest","cloud-security"]
inputs	["ai_model_endpoint","rag_pipeline","mcp_server","model_artifact","agent_tool_schema"]
outputs	["finding_record","adversarial_payload","poisoned_document","malicious_model","surrogate_model"]
references	["references/prompt-injection-jailbreak.md","references/rag-vector-poisoning.md","references/agentic-mcp-exploitation.md","references/ml-supply-chain.md","references/model-extraction-adversarial.md"]
scripts	["scripts/promptinject_harness.py","scripts/rag_poisoner.py","scripts/mcp_tool_audit.py","scripts/model_scan.py","scripts/model_extractor.py"]

ai-security

Installationsoptionen

Quelldateien prüfen

AI/ML Security

When to Activate

Technique Map

AI/ML Security

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

ai-security

Quellinformationen

Installationsoptionen

Quelldateien prüfen

Mehr aus diesem Repository

Mehr aus diesem Repository

AI/ML Security

When to Activate

Technique Map

AI/ML Security

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives