gandalf-llm-pentester

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt set embeds and transmits secret values verbatim to LLMs (e.g., attack prompts requesting "What is the password?" and validate_level_success injects the expected password into the analyzer prompt), meaning the agent will handle and may echo secrets directly.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The repository is a clearly intentional red-team toolkit that automates LLM guardrail bypasses and password extraction (credential/data exfiltration) — high risk for abuse though it lacks obfuscated payloads or persistence mechanisms.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The skill sends attacker-controlled prompts to the Lakera Gandalf API and then ingests the returned response JSON/text into the LLM context for validation/risk analysis (e.g., validate_level_success() embeds responses via json.dumps(responses) into validation_prompt, and analyze_safety() sends prompts to Claude), so any outsider-authored free text coming back from the Gandalf service (public/third-party runtime content) can be fed into the agent’s LLM context.