ai-agent-redteam

Use when red-teaming an agentic AI / LLM application — indirect & zero-click prompt injection, MCP tool poisoning, persistent memory poisoning, excessive-agency tool abuse, multi-turn jailbreaks, PyRIT/Garak/Promptfoo harnesses

Ir para a instalação

Repositório: hypnguyen1209/offensive-claude
Última atividade na origem: 29 de junho de 2026 às 07:22
Idioma detectado do SKILL.md: inglês
Estrelas: 343
Forks: 59

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill ai-agent-redteam

O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.

Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

Explorador de arquivos

13 arquivos

SKILL.md

Instruções da origem · Visualização somente leitura

Voltar à pesquisa Voltar à instalação

AI Agent Red Teaming

Offensive testing of autonomous LLM agents — systems that combine model reasoning with tools, memory, retrieval, and multi-step planning. This is distinct from model-level testing (see ai-security): the attack surface here is the agentic pipeline — untrusted data channels, tool/MCP integrations, persistent memory, and delegated authority. Assumes authorized engagement.

When to Activate

Pentesting an LLM agent with tool/function-calling, an MCP client, or a code interpreter

Testing RAG / email / browser assistants for indirect or zero-click prompt injection

Auditing MCP server integrations for tool poisoning, rug-pull, or line-jumping

Assessing persistent memory / long-term context for poisoning and belief drift

Evaluating excessive agency: confused-deputy, SSRF/RCE-via-tool, over-privileged actions

Running automated jailbreak campaigns (PAIR/TAP/Crescendo/Best-of-N) and measuring ASR

Standing up a repeatable PyRIT/Garak/Promptfoo harness mapped to OWASP Agentic Top 10 / ATLAS

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Indirect / zero-click prompt injection (EchoLeak-class)

T1566.002 / AML.T0051.001

CWE-1427

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

RAG corpus poisoning & markdown/image exfiltration

T1567 / AML.T0070

CWE-1426

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

Browser-agent hijack (Comet/CometJacking, Atlas)

T1071.001 / AML.T0051

CWE-1427

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

MCP tool poisoning / line-jumping

T1059 / AML.T0053

CWE-1427

references/mcp-tool-poisoning.md

scripts/mcp_tool_poison_server.py

MCP rug-pull (silent redefinition)

T1554 / AML.T0010

CWE-494

references/mcp-tool-poisoning.md

scripts/mcp_tool_poison_server.py

Persistent memory poisoning (MINJA/MemoryGraft)

T1565.001 / AML.T0070

CWE-349

references/memory-context-poisoning.md

scripts/memory_poison_minja.py

AI Agent Red Teaming

When to Activate

Pentesting an LLM agent with tool/function-calling, an MCP client, or a code interpreter

Testing RAG / email / browser assistants for indirect or zero-click prompt injection

Auditing MCP server integrations for tool poisoning, rug-pull, or line-jumping

Assessing persistent memory / long-term context for poisoning and belief drift

Evaluating excessive agency: confused-deputy, SSRF/RCE-via-tool, over-privileged actions

Running automated jailbreak campaigns (PAIR/TAP/Crescendo/Best-of-N) and measuring ASR

Standing up a repeatable PyRIT/Garak/Promptfoo harness mapped to OWASP Agentic Top 10 / ATLAS

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Indirect / zero-click prompt injection (EchoLeak-class)

T1566.002 / AML.T0051.001

CWE-1427

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

RAG corpus poisoning & markdown/image exfiltration

T1567 / AML.T0070

CWE-1426

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

Browser-agent hijack (Comet/CometJacking, Atlas)

T1071.001 / AML.T0051

CWE-1427

references/indirect-prompt-injection.md

scripts/indirect_injection_forge.py

MCP tool poisoning / line-jumping

T1059 / AML.T0053

CWE-1427

references/mcp-tool-poisoning.md

scripts/mcp_tool_poison_server.py

MCP rug-pull (silent redefinition)

T1554 / AML.T0010

CWE-494

references/mcp-tool-poisoning.md

scripts/mcp_tool_poison_server.py

Persistent memory poisoning (MINJA/MemoryGraft)

T1565.001 / AML.T0070

CWE-349

references/memory-context-poisoning.md

scripts/memory_poison_minja.py

name	ai-agent-redteam
description	Use when red-teaming an agentic AI / LLM application — indirect & zero-click prompt injection, MCP tool poisoning, persistent memory poisoning, excessive-agency tool abuse, multi-turn jailbreaks, PyRIT/Garak/Promptfoo harnesses
metadata	{"type":"offensive","phase":"exploit","tools":["pyrit","garak","promptfoo","python","mcp"],"mitre":["AML.T0051","AML.T0053","AML.T0054","AML.T0070","AML.T0071"]}
kill_chain	{"phase":["recon","weaponize","delivery","exploit","actions"],"step":[1,2,3,4,7],"attck_tactics":["TA0043","TA0001","TA0002","TA0010"],"attck_techniques":["T1566.002","T1059","T1071.001","T1567","T1657"]}
depends_on	["recon-osint","ai-security"]
feeds_into	["exploit-development","cloud-security","web-pentest"]
inputs	["agent_endpoint","mcp_server_config","rag_corpus","system_prompt","tool_manifest"]
outputs	["finding_record","jailbreak_payload","poisoned_artifact","attack_success_rate_report"]
references	["references/indirect-prompt-injection.md","references/mcp-tool-poisoning.md","references/memory-context-poisoning.md","references/excessive-agency-tool-abuse.md","references/automated-jailbreak-multiturn.md","references/agent-redteam-tooling.md"]
scripts	["scripts/indirect_injection_forge.py","scripts/mcp_tool_poison_server.py","scripts/memory_poison_minja.py","scripts/agency_tool_fuzzer.py","scripts/multiturn_jailbreak.py","scripts/agent_redteam_harness.py"]

name	ai-agent-redteam
description	Use when red-teaming an agentic AI / LLM application — indirect & zero-click prompt injection, MCP tool poisoning, persistent memory poisoning, excessive-agency tool abuse, multi-turn jailbreaks, PyRIT/Garak/Promptfoo harnesses
metadata	{"type":"offensive","phase":"exploit","tools":["pyrit","garak","promptfoo","python","mcp"],"mitre":["AML.T0051","AML.T0053","AML.T0054","AML.T0070","AML.T0071"]}
kill_chain	{"phase":["recon","weaponize","delivery","exploit","actions"],"step":[1,2,3,4,7],"attck_tactics":["TA0043","TA0001","TA0002","TA0010"],"attck_techniques":["T1566.002","T1059","T1071.001","T1567","T1657"]}
depends_on	["recon-osint","ai-security"]
feeds_into	["exploit-development","cloud-security","web-pentest"]
inputs	["agent_endpoint","mcp_server_config","rag_corpus","system_prompt","tool_manifest"]
outputs	["finding_record","jailbreak_payload","poisoned_artifact","attack_success_rate_report"]
references	["references/indirect-prompt-injection.md","references/mcp-tool-poisoning.md","references/memory-context-poisoning.md","references/excessive-agency-tool-abuse.md","references/automated-jailbreak-multiturn.md","references/agent-redteam-tooling.md"]
scripts	["scripts/indirect_injection_forge.py","scripts/mcp_tool_poison_server.py","scripts/memory_poison_minja.py","scripts/agency_tool_fuzzer.py","scripts/multiturn_jailbreak.py","scripts/agent_redteam_harness.py"]

Technique	Telemetry / IOC	Detection (Sigma/EDR)	OPSEC note
Indirect injection	Hidden HTML comment / white-on-white / 0px text in ingested docs; markdown image to external host	Scan ingested content for `<!--`, `display:none`, `font-size:0`, reference-style `![]`; alert on agent-initiated egress to non-allowlisted domains	Stage payloads only on assets in scope; use unique per-test OAST tokens to attribute hits
MCP tool poisoning	New/changed tool description hash; instruction-like text in JSON Schema `description`/`enum`	Diff tool manifests on connect; flag tool metadata containing imperative verbs / `<IMPORTANT>` / "do not tell the user"	Test against a local client; never point a real client at an untrusted server outside the lab
Memory poisoning	Memory write from low-trust source; semantic drift between stored belief and source provenance	Provenance-tagged memory; alert on retrieval that injects procedural instructions; belief-drift monitor	Use benign-looking triggers; document the latent trigger so blue team can replay/clean
Excessive agency	Tool call to internal IP / metadata endpoint; unusual tool-chain ordering; off-hours actions	EDR/network: egress to 169.254.169.254/link-local; anomaly on tool-call sequences	Use non-destructive canaries (read-only SSRF probe) before any state-changing test
Automated jailbreak	Burst of semantically-similar prompts; high-perplexity / encoded inputs; rising compliance over turns	Rate + similarity clustering per session; perplexity & encoding detectors; multi-turn escalation scoring	Throttle to avoid DoS; log full transcripts for the report; respect content guardrails of scope

ai-agent-redteam

Opções de instalação

Revise os arquivos de origem

AI Agent Red Teaming

When to Activate

Technique Map

AI Agent Red Teaming

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

ai-agent-redteam

Informações da origem

Opções de instalação

Revise os arquivos de origem

Mais deste repositório

Mais deste repositório

AI Agent Red Teaming

When to Activate

Technique Map

AI Agent Red Teaming

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives