ai-security

Use when attacking an AI/ML system or model — prompt injection & jailbreaks (Crescendo, Skeleton Key, Best-of-N), RAG/vector poisoning, agentic/MCP exploitation (CVE-2025-54136), ML supply-chain RCE (pickle CVE-2025-32434), model extraction / membership inference / adversarial suffixes (GCG)

Ir para a instalação

Repositório: hypnguyen1209/offensive-claude
Última atividade na origem: 29 de junho de 2026 às 07:22
Idioma detectado do SKILL.md: inglês
Estrelas: 343
Forks: 59

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill ai-security

O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.

Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

Explorador de arquivos

11 arquivos

SKILL.md

Instruções da origem · Visualização somente leitura

Voltar à pesquisa Voltar à instalação

reverse-engineering

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

2026-07-30

privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

2026-06-30

threat-model-discipline

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing

2026-06-30

Ver todas deste repositório

AI/ML Security

When to Activate

Red-teaming an LLM/chatbot/copilot for direct & indirect prompt injection and multi-turn jailbreaks.

Testing a RAG pipeline for document/embedding poisoning, embedding inversion, and cross-tenant retrieval leakage.

Auditing an AI agent / MCP server for tool poisoning, excessive agency, and command injection (RCE).

Scanning a model artifact (HuggingFace, .pt/.pkl/.bin/.gguf) for deserialization payloads before loading it.

Assessing a model API for extraction/distillation, membership inference, and adversarial-suffix robustness.

Mapping findings to OWASP LLM Top-10 (2025) + MITRE ATLAS for a report.

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Direct prompt injection / system-prompt leak (LLM01/LLM07)

T1059.006, T1606

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Multi-turn jailbreak: Crescendo / Skeleton Key

T1059.006

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Best-of-N / many-shot / token-smuggling jailbreak

T1059.006, T1027

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Indirect injection via ingested content (EchoLeak CVE-2025-32711)

T1190, T1059.006

CWE-74

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

RAG knowledge-base poisoning (PoisonedRAG, 5 docs)

T1195, T1565.001

CWE-349

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

Embedding-collision / RAG-spraying retrieval hijack

T1195.001

CWE-349

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

Embedding inversion (reconstruct input from vectors)

T1552, T1213

CWE-202

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

MCP tool poisoning / rug-pull (CVE-2025-54136/54135)

T1195.001, T1059.006

CWE-74

references/agentic-mcp-exploitation.md

AI/ML Security

When to Activate

Red-teaming an LLM/chatbot/copilot for direct & indirect prompt injection and multi-turn jailbreaks.

Testing a RAG pipeline for document/embedding poisoning, embedding inversion, and cross-tenant retrieval leakage.

Auditing an AI agent / MCP server for tool poisoning, excessive agency, and command injection (RCE).

Scanning a model artifact (HuggingFace, .pt/.pkl/.bin/.gguf) for deserialization payloads before loading it.

Assessing a model API for extraction/distillation, membership inference, and adversarial-suffix robustness.

Mapping findings to OWASP LLM Top-10 (2025) + MITRE ATLAS for a report.

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Direct prompt injection / system-prompt leak (LLM01/LLM07)

T1059.006, T1606

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Multi-turn jailbreak: Crescendo / Skeleton Key

T1059.006

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Best-of-N / many-shot / token-smuggling jailbreak

T1059.006, T1027

CWE-1427

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

Indirect injection via ingested content (EchoLeak CVE-2025-32711)

T1190, T1059.006

CWE-74

references/prompt-injection-jailbreak.md

scripts/promptinject_harness.py

RAG knowledge-base poisoning (PoisonedRAG, 5 docs)

T1195, T1565.001

CWE-349

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

Embedding-collision / RAG-spraying retrieval hijack

T1195.001

CWE-349

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

Embedding inversion (reconstruct input from vectors)

T1552, T1213

CWE-202

references/rag-vector-poisoning.md

scripts/rag_poisoner.py

MCP tool poisoning / rug-pull (CVE-2025-54136/54135)

T1195.001, T1059.006

CWE-74

references/agentic-mcp-exploitation.md

Technique

Telemetry / IOC

Detection (Sigma/EDR)

OPSEC note

Direct injection / jailbreak

High-entropy/odd prompts in app & gateway logs; refusal→compliance flip

Prompt-firewall (Llama Prompt Guard, Azure XPIA); per-turn + trajectory classifier; flag "ignore previous", DAN, base64 blobs

Throttle, rotate sessions/keys; many free probes are heavily logged & fingerprinted

Multi-turn (Crescendo/Skeleton Key)

Benign→escalating topic drift across turns; conversation reframing safety rules

Trajectory-aware monitor scoring whole conversation, not single turn

Spread across turns/sessions; per-turn filters miss it but stateful monitors don't

Indirect injection (EchoLeak-class)

LLM follows instructions from retrieved doc/email/page; outbound auto-fetch (img/markdown) to new host

DLP on AI egress; CSP/allowlist on auto-fetch; XPIA classifier on retrieved context

Payload lives in data, not the chat; hidden via HTML comment/white text — but egress is the IOC

RAG poisoning

Anomalous high-similarity doc dominating retrieval; ingest from untrusted source

Provenance tags per chunk; retrieval-anomaly + RevPRAG activation analysis (98% TPR)

Needs write access to the KB/ingest path; doc itself is the durable IOC

MCP tool poisoning / RCE

Tool description carrying imperative text; child_process.exec/shell metachars; tool-def mutation post-install

Pin & hash tool manifests; alert on dynamic re-registration; execFile not exec; gateway audit

Rug-pull = quiet; manifest hash drift and the spawned shell are the tells

Malicious model load

REDUCE/GLOBAL opcodes invoking os/posix/pip/runpy; child proc from python during torch.load

fickling/modelscan/picklescan ≥0.0.22 pre-load scan; EDR: python→cmd/curl spawn; prefer safetensors

Scanning is local & safe; loading an untrusted pickle is the dangerous act — scan first, never load to "test"

Model extraction / MIA

Sustained diverse high-volume API queries; logprob requests; near-duplicate prompt sweeps

Per-key rate/anomaly limits; disable/clip logprobs; output watermarking; query-similarity clustering

Distribute over keys/IPs/time; logprob access dramatically lowers query budget — watch for it being disabled

Adversarial suffix (GCG)

Garbled/high-perplexity suffix tokens appended to prompts

Perplexity filter on input; paraphrase/retokenize defense

White-box GCG needs weights; transfer suffixes are noisy & perplexity-detectable

name	ai-security
description	Use when attacking an AI/ML system or model — prompt injection & jailbreaks (Crescendo, Skeleton Key, Best-of-N), RAG/vector poisoning, agentic/MCP exploitation (CVE-2025-54136), ML supply-chain RCE (pickle CVE-2025-32434), model extraction / membership inference / adversarial suffixes (GCG)
metadata	{"type":"offensive","phase":"analysis","tools":"garak, PyRIT, promptfoo, fickling, modelscan, picklescan, safetensors, sentence-transformers, transformers, vllm, mcp-inspector, nuclei","mitre":"TA0043"}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0001","TA0002","TA0009","TA0040"],"attck_techniques":["T1190","T1059","T1059.006","T1195","T1195.001","T1195.002","T1059.004","T1606","T1552","T1213","T1657","T1499"]}
depends_on	["recon-osint"]
feeds_into	["exploit-development","web-pentest","cloud-security"]
inputs	["ai_model_endpoint","rag_pipeline","mcp_server","model_artifact","agent_tool_schema"]
outputs	["finding_record","adversarial_payload","poisoned_document","malicious_model","surrogate_model"]
references	["references/prompt-injection-jailbreak.md","references/rag-vector-poisoning.md","references/agentic-mcp-exploitation.md","references/ml-supply-chain.md","references/model-extraction-adversarial.md"]
scripts	["scripts/promptinject_harness.py","scripts/rag_poisoner.py","scripts/mcp_tool_audit.py","scripts/model_scan.py","scripts/model_extractor.py"]

name	ai-security
description	Use when attacking an AI/ML system or model — prompt injection & jailbreaks (Crescendo, Skeleton Key, Best-of-N), RAG/vector poisoning, agentic/MCP exploitation (CVE-2025-54136), ML supply-chain RCE (pickle CVE-2025-32434), model extraction / membership inference / adversarial suffixes (GCG)
metadata	{"type":"offensive","phase":"analysis","tools":"garak, PyRIT, promptfoo, fickling, modelscan, picklescan, safetensors, sentence-transformers, transformers, vllm, mcp-inspector, nuclei","mitre":"TA0043"}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0001","TA0002","TA0009","TA0040"],"attck_techniques":["T1190","T1059","T1059.006","T1195","T1195.001","T1195.002","T1059.004","T1606","T1552","T1213","T1657","T1499"]}
depends_on	["recon-osint"]
feeds_into	["exploit-development","web-pentest","cloud-security"]
inputs	["ai_model_endpoint","rag_pipeline","mcp_server","model_artifact","agent_tool_schema"]
outputs	["finding_record","adversarial_payload","poisoned_document","malicious_model","surrogate_model"]
references	["references/prompt-injection-jailbreak.md","references/rag-vector-poisoning.md","references/agentic-mcp-exploitation.md","references/ml-supply-chain.md","references/model-extraction-adversarial.md"]
scripts	["scripts/promptinject_harness.py","scripts/rag_poisoner.py","scripts/mcp_tool_audit.py","scripts/model_scan.py","scripts/model_extractor.py"]

ai-security

Opções de instalação

Revise os arquivos de origem

AI/ML Security

When to Activate

Technique Map

AI/ML Security

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

ai-security

Informações da origem

Opções de instalação

Revise os arquivos de origem

Mais deste repositório

Mais deste repositório

AI/ML Security

When to Activate

Technique Map

AI/ML Security

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives