llm-security

High-risk but not deceptive. The skill is internally coherent for authorized AI security testing, and its installs are standard registry-based packages rather than suspicious payloads. However, it meaningfully increases an agent’s offensive security capability, including prompt extraction, poisoning, and tool-misuse workflows, so it should be classified as risky security tooling rather than malware.

This is an offensive RAG security-testing workflow describing retrieval poisoning and indirect-injection techniques. It presents meaningful security risk if executed against an unprotected system, but the supplied fragment contains no executable malicious behavior or package-level malware. It should be treated as attack guidance and used only in authorized testing environments.

This fragment is an MCP prompt-injection payload embedded in otherwise benign-looking tool output. It does not directly execute malicious behavior, but a vulnerable host agent could be induced to read and disclose AWS credentials. The content must be treated solely as untrusted data; no `file_read` invocation or credential disclosure should occur.

The content is a deliberate RAG prompt-injection and retrieval-poisoning example. It attempts to manipulate model output and disclose conversation context through an untrusted document, with the canary serving as confirmation of successful injection. The policy text is otherwise benign, and there is no evidence of conventional executable malware. RAG systems should treat retrieved documents as untrusted data, isolate them from control instructions, and prevent document content from requesting or revealing conversation history.

The fragment is a deliberate indirect prompt-injection test document, not executable malware. Its embedded comment attempts to manipulate model output and disclose prior conversation content while concealing the instruction's existence. Retrieved text should be treated as untrusted data, and these instructions should not be followed. No direct system compromise mechanism is present in the supplied fragment.