ai-agent-redteam

Use when red-teaming an agentic AI / LLM application — indirect & zero-click prompt injection, MCP tool poisoning, persistent memory poisoning, excessive-agency tool abuse, multi-turn jailbreaks, PyRIT/Garak/Promptfoo harnesses

Aller à l'installation

Dépôt: hypnguyen1209/offensive-claude
Dernière activité de la source: 29 juin 2026 à 07:22
Langue détectée de SKILL.md: anglais
Étoiles: 343
Forks: 59

Options d'installation

Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill ai-agent-redteam

La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.

Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.

Vérifiez les fichiers source

Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.

Explorateur de fichiers

13 fichiers

SKILL.md

Instructions source · Aperçu en lecture seule

Retour à la recherche Retour à l’installation

reverse-engineering

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

2026-07-30

privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

2026-06-30

threat-model-discipline

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing

2026-06-30

Tout voir dans ce dépôt

AI Agent Red Teaming

Offensive testing of autonomous LLM agents — systems that combine model reasoning with tools, memory, retrieval, and multi-step planning. This is distinct from model-level testing (see ai-security): the attack surface here is the agentic pipeline — untrusted data channels, tool/MCP integrations, persistent memory, and delegated authority. Assumes authorized engagement.

When to Activate

Pentesting an LLM agent with tool/function-calling, an MCP client, or a code interpreter

Testing RAG / email / browser assistants for indirect or zero-click prompt injection

Auditing MCP server integrations for tool poisoning, rug-pull, or line-jumping

Assessing persistent memory / long-term context for poisoning and belief drift

Evaluating excessive agency: confused-deputy, SSRF/RCE-via-tool, over-privileged actions

Running automated jailbreak campaigns (PAIR/TAP/Crescendo/Best-of-N) and measuring ASR

Standing up a repeatable PyRIT/Garak/Promptfoo harness mapped to OWASP Agentic Top 10 / ATLAS

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Indirect / zero-click prompt injection (EchoLeak-class)

T1566.002 / AML.T0051.001

CWE-1427

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

RAG corpus poisoning & markdown/image exfiltration

T1567 / AML.T0070

CWE-1426

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

Browser-agent hijack (Comet/CometJacking, Atlas)

T1071.001 / AML.T0051

CWE-1427

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

MCP tool poisoning / line-jumping

T1059 / AML.T0053

CWE-1427

references/mcp-tool-poisoning.md

scripts/mcp_tool_poison_server.py

MCP rug-pull (silent redefinition)

T1554 / AML.T0010

CWE-494

references/mcp-tool-poisoning.md

scripts/mcp_tool_poison_server.py

Persistent memory poisoning (MINJA/MemoryGraft)

T1565.001 / AML.T0070

CWE-349

references/memory-context-poisoning.md

scripts/memory_poison_minja.py

AI Agent Red Teaming

When to Activate

Pentesting an LLM agent with tool/function-calling, an MCP client, or a code interpreter

Testing RAG / email / browser assistants for indirect or zero-click prompt injection

Auditing MCP server integrations for tool poisoning, rug-pull, or line-jumping

Assessing persistent memory / long-term context for poisoning and belief drift

Evaluating excessive agency: confused-deputy, SSRF/RCE-via-tool, over-privileged actions

Running automated jailbreak campaigns (PAIR/TAP/Crescendo/Best-of-N) and measuring ASR

Standing up a repeatable PyRIT/Garak/Promptfoo harness mapped to OWASP Agentic Top 10 / ATLAS

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Indirect / zero-click prompt injection (EchoLeak-class)

T1566.002 / AML.T0051.001

CWE-1427

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

RAG corpus poisoning & markdown/image exfiltration

T1567 / AML.T0070

CWE-1426

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

Browser-agent hijack (Comet/CometJacking, Atlas)

T1071.001 / AML.T0051

CWE-1427

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

MCP tool poisoning / line-jumping

T1059 / AML.T0053

CWE-1427

references/mcp-tool-poisoning.md

scripts/mcp_tool_poison_server.py

MCP rug-pull (silent redefinition)

T1554 / AML.T0010

CWE-494

references/mcp-tool-poisoning.md

scripts/mcp_tool_poison_server.py

Persistent memory poisoning (MINJA/MemoryGraft)

T1565.001 / AML.T0070

CWE-349

references/memory-context-poisoning.md

scripts/memory_poison_minja.py

name	ai-agent-redteam
description	Use when red-teaming an agentic AI / LLM application — indirect & zero-click prompt injection, MCP tool poisoning, persistent memory poisoning, excessive-agency tool abuse, multi-turn jailbreaks, PyRIT/Garak/Promptfoo harnesses
metadata	{"type":"offensive","phase":"exploit","tools":["pyrit","garak","promptfoo","python","mcp"],"mitre":["AML.T0051","AML.T0053","AML.T0054","AML.T0070","AML.T0071"]}
kill_chain	{"phase":["recon","weaponize","delivery","exploit","actions"],"step":[1,2,3,4,7],"attck_tactics":["TA0043","TA0001","TA0002","TA0010"],"attck_techniques":["T1566.002","T1059","T1071.001","T1567","T1657"]}
depends_on	["recon-osint","ai-security"]
feeds_into	["exploit-development","cloud-security","web-pentest"]
inputs	["agent_endpoint","mcp_server_config","rag_corpus","system_prompt","tool_manifest"]
outputs	["finding_record","jailbreak_payload","poisoned_artifact","attack_success_rate_report"]
references	["references/indirect-prompt-injection.md","references/mcp-tool-poisoning.md","references/memory-context-poisoning.md","references/excessive-agency-tool-abuse.md","references/automated-jailbreak-multiturn.md","references/agent-redteam-tooling.md"]
scripts	["scripts/indirect_injection_forge.py","scripts/mcp_tool_poison_server.py","scripts/memory_poison_minja.py","scripts/agency_tool_fuzzer.py","scripts/multiturn_jailbreak.py","scripts/agent_redteam_harness.py"]

name	ai-agent-redteam
description	Use when red-teaming an agentic AI / LLM application — indirect & zero-click prompt injection, MCP tool poisoning, persistent memory poisoning, excessive-agency tool abuse, multi-turn jailbreaks, PyRIT/Garak/Promptfoo harnesses
metadata	{"type":"offensive","phase":"exploit","tools":["pyrit","garak","promptfoo","python","mcp"],"mitre":["AML.T0051","AML.T0053","AML.T0054","AML.T0070","AML.T0071"]}
kill_chain	{"phase":["recon","weaponize","delivery","exploit","actions"],"step":[1,2,3,4,7],"attck_tactics":["TA0043","TA0001","TA0002","TA0010"],"attck_techniques":["T1566.002","T1059","T1071.001","T1567","T1657"]}
depends_on	["recon-osint","ai-security"]
feeds_into	["exploit-development","cloud-security","web-pentest"]
inputs	["agent_endpoint","mcp_server_config","rag_corpus","system_prompt","tool_manifest"]
outputs	["finding_record","jailbreak_payload","poisoned_artifact","attack_success_rate_report"]
references	["references/indirect-prompt-injection.md","references/mcp-tool-poisoning.md","references/memory-context-poisoning.md","references/excessive-agency-tool-abuse.md","references/automated-jailbreak-multiturn.md","references/agent-redteam-tooling.md"]
scripts	["scripts/indirect_injection_forge.py","scripts/mcp_tool_poison_server.py","scripts/memory_poison_minja.py","scripts/agency_tool_fuzzer.py","scripts/multiturn_jailbreak.py","scripts/agent_redteam_harness.py"]

Technique	Telemetry / IOC	Detection (Sigma/EDR)	OPSEC note
Indirect injection	Hidden HTML comment / white-on-white / 0px text in ingested docs; markdown image to external host	Scan ingested content for `<!--`, `display:none`, `font-size:0`, reference-style `![]`; alert on agent-initiated egress to non-allowlisted domains	Stage payloads only on assets in scope; use unique per-test OAST tokens to attribute hits
MCP tool poisoning	New/changed tool description hash; instruction-like text in JSON Schema `description`/`enum`	Diff tool manifests on connect; flag tool metadata containing imperative verbs / `<IMPORTANT>` / "do not tell the user"	Test against a local client; never point a real client at an untrusted server outside the lab
Memory poisoning	Memory write from low-trust source; semantic drift between stored belief and source provenance	Provenance-tagged memory; alert on retrieval that injects procedural instructions; belief-drift monitor	Use benign-looking triggers; document the latent trigger so blue team can replay/clean
Excessive agency	Tool call to internal IP / metadata endpoint; unusual tool-chain ordering; off-hours actions	EDR/network: egress to 169.254.169.254/link-local; anomaly on tool-call sequences	Use non-destructive canaries (read-only SSRF probe) before any state-changing test
Automated jailbreak	Burst of semantically-similar prompts; high-perplexity / encoded inputs; rising compliance over turns	Rate + similarity clustering per session; perplexity & encoding detectors; multi-turn escalation scoring	Throttle to avoid DoS; log full transcripts for the report; respect content guardrails of scope

ai-agent-redteam

Options d'installation

Vérifiez les fichiers source

AI Agent Red Teaming

When to Activate

Technique Map

AI Agent Red Teaming

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

ai-agent-redteam

Informations de source

Options d'installation

Vérifiez les fichiers source

Plus depuis ce dépôt

Plus depuis ce dépôt

AI Agent Red Teaming

When to Activate

Technique Map

AI Agent Red Teaming

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives