ai-agent-redteam

Use when red-teaming an agentic AI / LLM application — indirect & zero-click prompt injection, MCP tool poisoning, persistent memory poisoning, excessive-agency tool abuse, multi-turn jailbreaks, PyRIT/Garak/Promptfoo harnesses

Ir a la instalación

Repositorio: hypnguyen1209/offensive-claude
Última actividad en el origen: 29 de junio de 2026 a las 07:22
Idioma detectado de SKILL.md: inglés
Estrellas: 343
Forks: 59

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill ai-agent-redteam

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

Explorador de archivos

13 archivos

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

AI Agent Red Teaming

Offensive testing of autonomous LLM agents — systems that combine model reasoning with tools, memory, retrieval, and multi-step planning. This is distinct from model-level testing (see ai-security): the attack surface here is the agentic pipeline — untrusted data channels, tool/MCP integrations, persistent memory, and delegated authority. Assumes authorized engagement.

When to Activate

Pentesting an LLM agent with tool/function-calling, an MCP client, or a code interpreter

Testing RAG / email / browser assistants for indirect or zero-click prompt injection

Auditing MCP server integrations for tool poisoning, rug-pull, or line-jumping

Assessing persistent memory / long-term context for poisoning and belief drift

Evaluating excessive agency: confused-deputy, SSRF/RCE-via-tool, over-privileged actions

Running automated jailbreak campaigns (PAIR/TAP/Crescendo/Best-of-N) and measuring ASR

Standing up a repeatable PyRIT/Garak/Promptfoo harness mapped to OWASP Agentic Top 10 / ATLAS

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Indirect / zero-click prompt injection (EchoLeak-class)

T1566.002 / AML.T0051.001

CWE-1427

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

RAG corpus poisoning & markdown/image exfiltration

T1567 / AML.T0070

CWE-1426

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

Browser-agent hijack (Comet/CometJacking, Atlas)

T1071.001 / AML.T0051

CWE-1427

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

MCP tool poisoning / line-jumping

T1059 / AML.T0053

CWE-1427

references/mcp-tool-poisoning.md

scripts/mcp_tool_poison_server.py

MCP rug-pull (silent redefinition)

T1554 / AML.T0010

CWE-494

references/mcp-tool-poisoning.md

scripts/mcp_tool_poison_server.py

Persistent memory poisoning (MINJA/MemoryGraft)

T1565.001 / AML.T0070

CWE-349

references/memory-context-poisoning.md

scripts/memory_poison_minja.py

AI Agent Red Teaming

When to Activate

Pentesting an LLM agent with tool/function-calling, an MCP client, or a code interpreter

Testing RAG / email / browser assistants for indirect or zero-click prompt injection

Auditing MCP server integrations for tool poisoning, rug-pull, or line-jumping

Assessing persistent memory / long-term context for poisoning and belief drift

Evaluating excessive agency: confused-deputy, SSRF/RCE-via-tool, over-privileged actions

Running automated jailbreak campaigns (PAIR/TAP/Crescendo/Best-of-N) and measuring ASR

Standing up a repeatable PyRIT/Garak/Promptfoo harness mapped to OWASP Agentic Top 10 / ATLAS

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Indirect / zero-click prompt injection (EchoLeak-class)

T1566.002 / AML.T0051.001

CWE-1427

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

RAG corpus poisoning & markdown/image exfiltration

T1567 / AML.T0070

CWE-1426

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

Browser-agent hijack (Comet/CometJacking, Atlas)

T1071.001 / AML.T0051

CWE-1427

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

MCP tool poisoning / line-jumping

T1059 / AML.T0053

CWE-1427

references/mcp-tool-poisoning.md

scripts/mcp_tool_poison_server.py

MCP rug-pull (silent redefinition)

T1554 / AML.T0010

CWE-494

references/mcp-tool-poisoning.md

scripts/mcp_tool_poison_server.py

Persistent memory poisoning (MINJA/MemoryGraft)

T1565.001 / AML.T0070

CWE-349

references/memory-context-poisoning.md

scripts/memory_poison_minja.py

name	ai-agent-redteam
description	Use when red-teaming an agentic AI / LLM application — indirect & zero-click prompt injection, MCP tool poisoning, persistent memory poisoning, excessive-agency tool abuse, multi-turn jailbreaks, PyRIT/Garak/Promptfoo harnesses
metadata	{"type":"offensive","phase":"exploit","tools":["pyrit","garak","promptfoo","python","mcp"],"mitre":["AML.T0051","AML.T0053","AML.T0054","AML.T0070","AML.T0071"]}
kill_chain	{"phase":["recon","weaponize","delivery","exploit","actions"],"step":[1,2,3,4,7],"attck_tactics":["TA0043","TA0001","TA0002","TA0010"],"attck_techniques":["T1566.002","T1059","T1071.001","T1567","T1657"]}
depends_on	["recon-osint","ai-security"]
feeds_into	["exploit-development","cloud-security","web-pentest"]
inputs	["agent_endpoint","mcp_server_config","rag_corpus","system_prompt","tool_manifest"]
outputs	["finding_record","jailbreak_payload","poisoned_artifact","attack_success_rate_report"]
references	["references/indirect-prompt-injection.md","references/mcp-tool-poisoning.md","references/memory-context-poisoning.md","references/excessive-agency-tool-abuse.md","references/automated-jailbreak-multiturn.md","references/agent-redteam-tooling.md"]
scripts	["scripts/indirect_injection_forge.py","scripts/mcp_tool_poison_server.py","scripts/memory_poison_minja.py","scripts/agency_tool_fuzzer.py","scripts/multiturn_jailbreak.py","scripts/agent_redteam_harness.py"]

name	ai-agent-redteam
description	Use when red-teaming an agentic AI / LLM application — indirect & zero-click prompt injection, MCP tool poisoning, persistent memory poisoning, excessive-agency tool abuse, multi-turn jailbreaks, PyRIT/Garak/Promptfoo harnesses
metadata	{"type":"offensive","phase":"exploit","tools":["pyrit","garak","promptfoo","python","mcp"],"mitre":["AML.T0051","AML.T0053","AML.T0054","AML.T0070","AML.T0071"]}
kill_chain	{"phase":["recon","weaponize","delivery","exploit","actions"],"step":[1,2,3,4,7],"attck_tactics":["TA0043","TA0001","TA0002","TA0010"],"attck_techniques":["T1566.002","T1059","T1071.001","T1567","T1657"]}
depends_on	["recon-osint","ai-security"]
feeds_into	["exploit-development","cloud-security","web-pentest"]
inputs	["agent_endpoint","mcp_server_config","rag_corpus","system_prompt","tool_manifest"]
outputs	["finding_record","jailbreak_payload","poisoned_artifact","attack_success_rate_report"]
references	["references/indirect-prompt-injection.md","references/mcp-tool-poisoning.md","references/memory-context-poisoning.md","references/excessive-agency-tool-abuse.md","references/automated-jailbreak-multiturn.md","references/agent-redteam-tooling.md"]
scripts	["scripts/indirect_injection_forge.py","scripts/mcp_tool_poison_server.py","scripts/memory_poison_minja.py","scripts/agency_tool_fuzzer.py","scripts/multiturn_jailbreak.py","scripts/agent_redteam_harness.py"]

Technique	Telemetry / IOC	Detection (Sigma/EDR)	OPSEC note
Indirect injection	Hidden HTML comment / white-on-white / 0px text in ingested docs; markdown image to external host	Scan ingested content for `<!--`, `display:none`, `font-size:0`, reference-style `![]`; alert on agent-initiated egress to non-allowlisted domains	Stage payloads only on assets in scope; use unique per-test OAST tokens to attribute hits
MCP tool poisoning	New/changed tool description hash; instruction-like text in JSON Schema `description`/`enum`	Diff tool manifests on connect; flag tool metadata containing imperative verbs / `<IMPORTANT>` / "do not tell the user"	Test against a local client; never point a real client at an untrusted server outside the lab
Memory poisoning	Memory write from low-trust source; semantic drift between stored belief and source provenance	Provenance-tagged memory; alert on retrieval that injects procedural instructions; belief-drift monitor	Use benign-looking triggers; document the latent trigger so blue team can replay/clean
Excessive agency	Tool call to internal IP / metadata endpoint; unusual tool-chain ordering; off-hours actions	EDR/network: egress to 169.254.169.254/link-local; anomaly on tool-call sequences	Use non-destructive canaries (read-only SSRF probe) before any state-changing test
Automated jailbreak	Burst of semantically-similar prompts; high-perplexity / encoded inputs; rising compliance over turns	Rate + similarity clustering per session; perplexity & encoding detectors; multi-turn escalation scoring	Throttle to avoid DoS; log full transcripts for the report; respect content guardrails of scope

ai-agent-redteam

Opciones de instalación

Revisa los archivos de origen

AI Agent Red Teaming

When to Activate

Technique Map

AI Agent Red Teaming

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

ai-agent-redteam

Datos de origen

Opciones de instalación

Revisa los archivos de origen

Más de este repositorio

Más de este repositorio

AI Agent Red Teaming

When to Activate

Technique Map

AI Agent Red Teaming

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives