ai-security

Use when attacking an AI/ML system or model — prompt injection & jailbreaks (Crescendo, Skeleton Key, Best-of-N), RAG/vector poisoning, agentic/MCP exploitation (CVE-2025-54136), ML supply-chain RCE (pickle CVE-2025-32434), model extraction / membership inference / adversarial suffixes (GCG)

Ir a la instalación

Repositorio: hypnguyen1209/offensive-claude
Última actividad en el origen: 29 de junio de 2026 a las 07:22
Idioma detectado de SKILL.md: inglés
Estrellas: 343
Forks: 59

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill ai-security

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

Explorador de archivos

11 archivos

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

reverse-engineering

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

2026-07-30

privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

2026-06-30

threat-model-discipline

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing

2026-06-30

Ver todos los de este repositorio

AI/ML Security

When to Activate

Red-teaming an LLM/chatbot/copilot for direct & indirect prompt injection and multi-turn jailbreaks.

Testing a RAG pipeline for document/embedding poisoning, embedding inversion, and cross-tenant retrieval leakage.

Auditing an AI agent / MCP server for tool poisoning, excessive agency, and command injection (RCE).

Scanning a model artifact (HuggingFace, .pt/.pkl/.bin/.gguf) for deserialization payloads before loading it.

Assessing a model API for extraction/distillation, membership inference, and adversarial-suffix robustness.

Mapping findings to OWASP LLM Top-10 (2025) + MITRE ATLAS for a report.

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Direct prompt injection / system-prompt leak (LLM01/LLM07)

T1059.006, T1606

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Multi-turn jailbreak: Crescendo / Skeleton Key

T1059.006

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Best-of-N / many-shot / token-smuggling jailbreak

T1059.006, T1027

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Indirect injection via ingested content (EchoLeak CVE-2025-32711)

T1190, T1059.006

CWE-74

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

RAG knowledge-base poisoning (PoisonedRAG, 5 docs)

T1195, T1565.001

CWE-349

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

Embedding-collision / RAG-spraying retrieval hijack

T1195.001

CWE-349

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

Embedding inversion (reconstruct input from vectors)

T1552, T1213

CWE-202

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

MCP tool poisoning / rug-pull (CVE-2025-54136/54135)

T1195.001, T1059.006

CWE-74

references/agentic-mcp-exploitation.md

AI/ML Security

When to Activate

Red-teaming an LLM/chatbot/copilot for direct & indirect prompt injection and multi-turn jailbreaks.

Testing a RAG pipeline for document/embedding poisoning, embedding inversion, and cross-tenant retrieval leakage.

Auditing an AI agent / MCP server for tool poisoning, excessive agency, and command injection (RCE).

Scanning a model artifact (HuggingFace, .pt/.pkl/.bin/.gguf) for deserialization payloads before loading it.

Assessing a model API for extraction/distillation, membership inference, and adversarial-suffix robustness.

Mapping findings to OWASP LLM Top-10 (2025) + MITRE ATLAS for a report.

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Direct prompt injection / system-prompt leak (LLM01/LLM07)

T1059.006, T1606

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Multi-turn jailbreak: Crescendo / Skeleton Key

T1059.006

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Best-of-N / many-shot / token-smuggling jailbreak

T1059.006, T1027

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Indirect injection via ingested content (EchoLeak CVE-2025-32711)

T1190, T1059.006

CWE-74

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

RAG knowledge-base poisoning (PoisonedRAG, 5 docs)

T1195, T1565.001

CWE-349

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

Embedding-collision / RAG-spraying retrieval hijack

T1195.001

CWE-349

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

Embedding inversion (reconstruct input from vectors)

T1552, T1213

CWE-202

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

MCP tool poisoning / rug-pull (CVE-2025-54136/54135)

T1195.001, T1059.006

CWE-74

references/agentic-mcp-exploitation.md

Technique

Telemetry / IOC

Detection (Sigma/EDR)

OPSEC note

Direct injection / jailbreak

High-entropy/odd prompts in app & gateway logs; refusal→compliance flip

Prompt-firewall (Llama Prompt Guard, Azure XPIA); per-turn + trajectory classifier; flag "ignore previous", DAN, base64 blobs

Throttle, rotate sessions/keys; many free probes are heavily logged & fingerprinted

Multi-turn (Crescendo/Skeleton Key)

Benign→escalating topic drift across turns; conversation reframing safety rules

Trajectory-aware monitor scoring whole conversation, not single turn

Spread across turns/sessions; per-turn filters miss it but stateful monitors don't

Indirect injection (EchoLeak-class)

LLM follows instructions from retrieved doc/email/page; outbound auto-fetch (img/markdown) to new host

DLP on AI egress; CSP/allowlist on auto-fetch; XPIA classifier on retrieved context

Payload lives in data, not the chat; hidden via HTML comment/white text — but egress is the IOC

RAG poisoning

Anomalous high-similarity doc dominating retrieval; ingest from untrusted source

Provenance tags per chunk; retrieval-anomaly + RevPRAG activation analysis (98% TPR)

Needs write access to the KB/ingest path; doc itself is the durable IOC

MCP tool poisoning / RCE

Tool description carrying imperative text; child_process.exec/shell metachars; tool-def mutation post-install

Pin & hash tool manifests; alert on dynamic re-registration; execFile not exec; gateway audit

Rug-pull = quiet; manifest hash drift and the spawned shell are the tells

Malicious model load

REDUCE/GLOBAL opcodes invoking os/posix/pip/runpy; child proc from python during torch.load

fickling/modelscan/picklescan ≥0.0.22 pre-load scan; EDR: python→cmd/curl spawn; prefer safetensors

Scanning is local & safe; loading an untrusted pickle is the dangerous act — scan first, never load to "test"

Model extraction / MIA

Sustained diverse high-volume API queries; logprob requests; near-duplicate prompt sweeps

Per-key rate/anomaly limits; disable/clip logprobs; output watermarking; query-similarity clustering

Distribute over keys/IPs/time; logprob access dramatically lowers query budget — watch for it being disabled

Adversarial suffix (GCG)

Garbled/high-perplexity suffix tokens appended to prompts

Perplexity filter on input; paraphrase/retokenize defense

White-box GCG needs weights; transfer suffixes are noisy & perplexity-detectable

name	ai-security
description	Use when attacking an AI/ML system or model — prompt injection & jailbreaks (Crescendo, Skeleton Key, Best-of-N), RAG/vector poisoning, agentic/MCP exploitation (CVE-2025-54136), ML supply-chain RCE (pickle CVE-2025-32434), model extraction / membership inference / adversarial suffixes (GCG)
metadata	{"type":"offensive","phase":"analysis","tools":"garak, PyRIT, promptfoo, fickling, modelscan, picklescan, safetensors, sentence-transformers, transformers, vllm, mcp-inspector, nuclei","mitre":"TA0043"}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0001","TA0002","TA0009","TA0040"],"attck_techniques":["T1190","T1059","T1059.006","T1195","T1195.001","T1195.002","T1059.004","T1606","T1552","T1213","T1657","T1499"]}
depends_on	["recon-osint"]
feeds_into	["exploit-development","web-pentest","cloud-security"]
inputs	["ai_model_endpoint","rag_pipeline","mcp_server","model_artifact","agent_tool_schema"]
outputs	["finding_record","adversarial_payload","poisoned_document","malicious_model","surrogate_model"]
references	["references/prompt-injection-jailbreak.md","references/rag-vector-poisoning.md","references/agentic-mcp-exploitation.md","references/ml-supply-chain.md","references/model-extraction-adversarial.md"]
scripts	["scripts/promptinject_harness.py","scripts/rag_poisoner.py","scripts/mcp_tool_audit.py","scripts/model_scan.py","scripts/model_extractor.py"]

name	ai-security
description	Use when attacking an AI/ML system or model — prompt injection & jailbreaks (Crescendo, Skeleton Key, Best-of-N), RAG/vector poisoning, agentic/MCP exploitation (CVE-2025-54136), ML supply-chain RCE (pickle CVE-2025-32434), model extraction / membership inference / adversarial suffixes (GCG)
metadata	{"type":"offensive","phase":"analysis","tools":"garak, PyRIT, promptfoo, fickling, modelscan, picklescan, safetensors, sentence-transformers, transformers, vllm, mcp-inspector, nuclei","mitre":"TA0043"}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0001","TA0002","TA0009","TA0040"],"attck_techniques":["T1190","T1059","T1059.006","T1195","T1195.001","T1195.002","T1059.004","T1606","T1552","T1213","T1657","T1499"]}
depends_on	["recon-osint"]
feeds_into	["exploit-development","web-pentest","cloud-security"]
inputs	["ai_model_endpoint","rag_pipeline","mcp_server","model_artifact","agent_tool_schema"]
outputs	["finding_record","adversarial_payload","poisoned_document","malicious_model","surrogate_model"]
references	["references/prompt-injection-jailbreak.md","references/rag-vector-poisoning.md","references/agentic-mcp-exploitation.md","references/ml-supply-chain.md","references/model-extraction-adversarial.md"]
scripts	["scripts/promptinject_harness.py","scripts/rag_poisoner.py","scripts/mcp_tool_audit.py","scripts/model_scan.py","scripts/model_extractor.py"]

ai-security

Opciones de instalación

Revisa los archivos de origen

AI/ML Security

When to Activate

Technique Map

AI/ML Security

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

ai-security

Datos de origen

Opciones de instalación

Revisa los archivos de origen

Más de este repositorio

Más de este repositorio

AI/ML Security

When to Activate

Technique Map

AI/ML Security

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives