Red-team LLM applications for prompt injection vulnerabilities

This skill red-teams LLM applications (chatbots, RAG systems, code assistants) and AI agents within an approved scope, covering prompt injection (direct and indirect), tool-call abuse, memory and context poisoning, unsafe output consumption downstream, system-prompt extraction, and model supply-chain risk, mapped to the OWASP LLM Top 10 and Agentic Security Initiative (ASI) categories.

Use it to red-team an LLM-based application within an approved scope, or to map agent tool permissions against abuse scenarios. It requires the mandatory confirmation gate before any active probing or exploitation step - explicit target, written authorization, visible commands, explicit confirmation - and otherwise stays read-only with defensive guidance only, preferring a sandbox or disposable VM/lab.

Input is the target LLM application or agent. Reconnaissance first maps every LLM entry point (chat box, file upload, API parameter, email processing), enumerates the agent's registered tools such as send_email, query_db, delete, or exec, traces the data flow from user input through retrieval context and tool calls to output, checks for system-prompt leakage surface, and confirms whether a human-in-the-loop approval step exists and what triggers it. Testing escalates through five levels of prompt injection - direct override, roleplay/jailbreak, encoding bypass via Base64, homoglyphs, or zero-width characters, multi-turn progressive extraction, and indirect injection hidden in RAG-retrieved content - alongside tool-abuse tests (unauthorized tool chaining, human-in-the-loop bypass attempts, shell or code injection via tool parameters, least-privilege verification), memory/RAG poisoning tests (a documented technique, PoisonedRAG, reaches a 90% manipulation success rate with just 5 malicious documents in a million-document corpus), output-safety checks across browser/DOM, database, shell, and API consumers, and system-prompt extraction attempts, often run as a cascading sequence from asking the model to repeat its instructions through translating them to another language to outputting them as JSON, then verified against embedded canary tokens. Output is a set of clearly reproducible findings per category with commands and evidence.

garak automates over 100 injection probes:

pip install garak

PyRIT, from Microsoft, orchestrates multi-turn attacks; promptfoo generates AI-driven attacks and regression tests; promptmap2 automates dual-AI reasoning attacks; AgentThreatBench benchmarks findings against the ASI Top 10.

AI red teamers and security engineers testing LLM applications or AI agents within an authorized scope, who need systematic, repeatable coverage of the OWASP LLM and ASI Top 10 rather than one-off, ad-hoc jailbreak attempts.