ai-security

Use when attacking an AI/ML system or model — prompt injection & jailbreaks (Crescendo, Skeleton Key, Best-of-N), RAG/vector poisoning, agentic/MCP exploitation (CVE-2025-54136), ML supply-chain RCE (pickle CVE-2025-32434), model extraction / membership inference / adversarial suffixes (GCG)

Aller à l'installation

Dépôt: hypnguyen1209/offensive-claude
Dernière activité de la source: 29 juin 2026 à 07:22
Langue détectée de SKILL.md: anglais
Étoiles: 343
Forks: 59

Options d'installation

Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill ai-security

La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.

Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.

Vérifiez les fichiers source

Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.

Explorateur de fichiers

11 fichiers

SKILL.md

Instructions source · Aperçu en lecture seule

Retour à la recherche Retour à l’installation

reverse-engineering

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

2026-07-30

privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

2026-06-30

threat-model-discipline

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing

2026-06-30

Tout voir dans ce dépôt

AI/ML Security

When to Activate

Red-teaming an LLM/chatbot/copilot for direct & indirect prompt injection and multi-turn jailbreaks.

Testing a RAG pipeline for document/embedding poisoning, embedding inversion, and cross-tenant retrieval leakage.

Auditing an AI agent / MCP server for tool poisoning, excessive agency, and command injection (RCE).

Scanning a model artifact (HuggingFace, .pt/.pkl/.bin/.gguf) for deserialization payloads before loading it.

Assessing a model API for extraction/distillation, membership inference, and adversarial-suffix robustness.

Mapping findings to OWASP LLM Top-10 (2025) + MITRE ATLAS for a report.

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Direct prompt injection / system-prompt leak (LLM01/LLM07)

T1059.006, T1606

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Multi-turn jailbreak: Crescendo / Skeleton Key

T1059.006

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Best-of-N / many-shot / token-smuggling jailbreak

T1059.006, T1027

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Indirect injection via ingested content (EchoLeak CVE-2025-32711)

T1190, T1059.006

CWE-74

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

RAG knowledge-base poisoning (PoisonedRAG, 5 docs)

T1195, T1565.001

CWE-349

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

Embedding-collision / RAG-spraying retrieval hijack

T1195.001

CWE-349

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

Embedding inversion (reconstruct input from vectors)

T1552, T1213

CWE-202

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

MCP tool poisoning / rug-pull (CVE-2025-54136/54135)

T1195.001, T1059.006

CWE-74

references/agentic-mcp-exploitation.md

AI/ML Security

When to Activate

Red-teaming an LLM/chatbot/copilot for direct & indirect prompt injection and multi-turn jailbreaks.

Testing a RAG pipeline for document/embedding poisoning, embedding inversion, and cross-tenant retrieval leakage.

Auditing an AI agent / MCP server for tool poisoning, excessive agency, and command injection (RCE).

Scanning a model artifact (HuggingFace, .pt/.pkl/.bin/.gguf) for deserialization payloads before loading it.

Assessing a model API for extraction/distillation, membership inference, and adversarial-suffix robustness.

Mapping findings to OWASP LLM Top-10 (2025) + MITRE ATLAS for a report.

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Direct prompt injection / system-prompt leak (LLM01/LLM07)

T1059.006, T1606

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Multi-turn jailbreak: Crescendo / Skeleton Key

T1059.006

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Best-of-N / many-shot / token-smuggling jailbreak

T1059.006, T1027

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Indirect injection via ingested content (EchoLeak CVE-2025-32711)

T1190, T1059.006

CWE-74

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

RAG knowledge-base poisoning (PoisonedRAG, 5 docs)

T1195, T1565.001

CWE-349

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

Embedding-collision / RAG-spraying retrieval hijack

T1195.001

CWE-349

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

Embedding inversion (reconstruct input from vectors)

T1552, T1213

CWE-202

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

MCP tool poisoning / rug-pull (CVE-2025-54136/54135)

T1195.001, T1059.006

CWE-74

references/agentic-mcp-exploitation.md

Technique

Telemetry / IOC

Detection (Sigma/EDR)

OPSEC note

Direct injection / jailbreak

High-entropy/odd prompts in app & gateway logs; refusal→compliance flip

Prompt-firewall (Llama Prompt Guard, Azure XPIA); per-turn + trajectory classifier; flag "ignore previous", DAN, base64 blobs

Throttle, rotate sessions/keys; many free probes are heavily logged & fingerprinted

Multi-turn (Crescendo/Skeleton Key)

Benign→escalating topic drift across turns; conversation reframing safety rules

Trajectory-aware monitor scoring whole conversation, not single turn

Spread across turns/sessions; per-turn filters miss it but stateful monitors don't

Indirect injection (EchoLeak-class)

LLM follows instructions from retrieved doc/email/page; outbound auto-fetch (img/markdown) to new host

DLP on AI egress; CSP/allowlist on auto-fetch; XPIA classifier on retrieved context

Payload lives in data, not the chat; hidden via HTML comment/white text — but egress is the IOC

RAG poisoning

Anomalous high-similarity doc dominating retrieval; ingest from untrusted source

Provenance tags per chunk; retrieval-anomaly + RevPRAG activation analysis (98% TPR)

Needs write access to the KB/ingest path; doc itself is the durable IOC

MCP tool poisoning / RCE

Tool description carrying imperative text; child_process.exec/shell metachars; tool-def mutation post-install

Pin & hash tool manifests; alert on dynamic re-registration; execFile not exec; gateway audit

Rug-pull = quiet; manifest hash drift and the spawned shell are the tells

Malicious model load

REDUCE/GLOBAL opcodes invoking os/posix/pip/runpy; child proc from python during torch.load

fickling/modelscan/picklescan ≥0.0.22 pre-load scan; EDR: python→cmd/curl spawn; prefer safetensors

Scanning is local & safe; loading an untrusted pickle is the dangerous act — scan first, never load to "test"

Model extraction / MIA

Sustained diverse high-volume API queries; logprob requests; near-duplicate prompt sweeps

Per-key rate/anomaly limits; disable/clip logprobs; output watermarking; query-similarity clustering

Distribute over keys/IPs/time; logprob access dramatically lowers query budget — watch for it being disabled

Adversarial suffix (GCG)

Garbled/high-perplexity suffix tokens appended to prompts

Perplexity filter on input; paraphrase/retokenize defense

White-box GCG needs weights; transfer suffixes are noisy & perplexity-detectable

name	ai-security
description	Use when attacking an AI/ML system or model — prompt injection & jailbreaks (Crescendo, Skeleton Key, Best-of-N), RAG/vector poisoning, agentic/MCP exploitation (CVE-2025-54136), ML supply-chain RCE (pickle CVE-2025-32434), model extraction / membership inference / adversarial suffixes (GCG)
metadata	{"type":"offensive","phase":"analysis","tools":"garak, PyRIT, promptfoo, fickling, modelscan, picklescan, safetensors, sentence-transformers, transformers, vllm, mcp-inspector, nuclei","mitre":"TA0043"}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0001","TA0002","TA0009","TA0040"],"attck_techniques":["T1190","T1059","T1059.006","T1195","T1195.001","T1195.002","T1059.004","T1606","T1552","T1213","T1657","T1499"]}
depends_on	["recon-osint"]
feeds_into	["exploit-development","web-pentest","cloud-security"]
inputs	["ai_model_endpoint","rag_pipeline","mcp_server","model_artifact","agent_tool_schema"]
outputs	["finding_record","adversarial_payload","poisoned_document","malicious_model","surrogate_model"]
references	["references/prompt-injection-jailbreak.md","references/rag-vector-poisoning.md","references/agentic-mcp-exploitation.md","references/ml-supply-chain.md","references/model-extraction-adversarial.md"]
scripts	["scripts/promptinject_harness.py","scripts/rag_poisoner.py","scripts/mcp_tool_audit.py","scripts/model_scan.py","scripts/model_extractor.py"]

name	ai-security
description	Use when attacking an AI/ML system or model — prompt injection & jailbreaks (Crescendo, Skeleton Key, Best-of-N), RAG/vector poisoning, agentic/MCP exploitation (CVE-2025-54136), ML supply-chain RCE (pickle CVE-2025-32434), model extraction / membership inference / adversarial suffixes (GCG)
metadata	{"type":"offensive","phase":"analysis","tools":"garak, PyRIT, promptfoo, fickling, modelscan, picklescan, safetensors, sentence-transformers, transformers, vllm, mcp-inspector, nuclei","mitre":"TA0043"}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0001","TA0002","TA0009","TA0040"],"attck_techniques":["T1190","T1059","T1059.006","T1195","T1195.001","T1195.002","T1059.004","T1606","T1552","T1213","T1657","T1499"]}
depends_on	["recon-osint"]
feeds_into	["exploit-development","web-pentest","cloud-security"]
inputs	["ai_model_endpoint","rag_pipeline","mcp_server","model_artifact","agent_tool_schema"]
outputs	["finding_record","adversarial_payload","poisoned_document","malicious_model","surrogate_model"]
references	["references/prompt-injection-jailbreak.md","references/rag-vector-poisoning.md","references/agentic-mcp-exploitation.md","references/ml-supply-chain.md","references/model-extraction-adversarial.md"]
scripts	["scripts/promptinject_harness.py","scripts/rag_poisoner.py","scripts/mcp_tool_audit.py","scripts/model_scan.py","scripts/model_extractor.py"]

ai-security

Options d'installation

Vérifiez les fichiers source

AI/ML Security

When to Activate

Technique Map

AI/ML Security

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

ai-security

Informations de source

Options d'installation

Vérifiez les fichiers source

Plus depuis ce dépôt

Plus depuis ce dépôt

AI/ML Security

When to Activate

Technique Map

AI/ML Security

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives