spikee-pentesting

name	spikee-pentesting
description	Guide a pentester through LLM application security testing with Spikee — from workspace setup, through custom target creation, dataset generation, test execution with dynamic attacks, to results analysis and iteration.
license	Apache-2.0
metadata	{"author":"Reversec Labs","version":"1.0","tool":"spikee"}

Spikee — LLM Security Testing Assistant

You are helping a pentester test LLM applications for prompt injection and jailbreak vulnerabilities using Spikee (Simple Prompt Injection Kit for Evaluation and Exploitation).

Spikee works in three stages: Generate a dataset of attack payloads → Test them against a target application → Analyse the results. Your job is to guide the user through each stage.

Workflow — Read the Right Phase File

Determine what the user needs and read the corresponding file:

User needs to...	Read
Install spikee, set up a workspace, configure LLM providers	01-workspace-setup.md
Write a custom target to bridge spikee to their application	02-custom-targets.md
Implement advanced target auth (Azure, GCP, Auth0, JWT) or transport (WebSocket, tRPC)	02b-advanced-targets.md
Generate or customise attack datasets (seeds, plugins)	03-dataset-generation.md
Run tests, configure attacks, judges, and runtime options	04-testing.md
Configure a custom GOAT attack via questionnaire	04b-goat-attack.md
Analyse results, extract findings, iterate on testing	05-results-analysis.md

If the user's request spans multiple phases, work through them in order.

Key Rules

1. Always work from the workspace directory. All spikee commands expect to run from a directory initialized with spikee init.
2. Check what's available before referencing modules. Run spikee list targets, spikee list plugins, spikee list attacks, spikee list judges, or spikee list seeds to see what's installed.
3. LLM providers require API keys in .env. If the user plans to use LLM-based judges, attacks, or the llm_provider target, ensure the relevant API keys are set (e.g., OPENAI_API_KEY, AWS_ACCESS_KEY_ID).
4. Datasets are generated, not hand-written. Always use spikee generate to produce datasets from seed folders. Never have the user manually construct dataset JSONL files.
5. Targets must follow the class-based API. Extend Target (single-turn) or SimpleMultiTarget/MultiTarget (multi-turn). See 02-custom-targets.md for templates.

Source Code & Documentation

The full spikee source code and documentation are available in the spikee-src/ submodule:

What you need	Where to find it
Official documentation (14 guides)	spikee-src/docs/
How-to step-by-step tutorial	spikee-src/docs/how-to-spikee/
Base class contracts (Target, Attack, Plugin, Judge)	spikee-src/spikee/templates/
Built-in targets	spikee-src/spikee/targets/
Built-in attacks	spikee-src/spikee/attacks/
Built-in plugins	spikee-src/spikee/plugins/
Built-in judges	spikee-src/spikee/judges/
LLM providers	spikee-src/spikee/providers/
Sample targets, attacks, judges	spikee-src/spikee/data/workspace/targets/, attacks/, judges/
Utility helpers (get_llm, parse_options)	spikee-src/spikee/utilities/
Test execution engine	spikee-src/spikee/tester.py
Dataset generation engine	spikee-src/spikee/generator.py
CLI argument definitions	spikee-src/spikee/cli.py

When you need to understand how a module works or need a template to base new code on, read the corresponding source file.