The Agent Skills Directory

[PROMPT_INJECTION]: The skill provides extensive reference material and automated payloads for testing direct and indirect prompt injection.
Evidence includes techniques such as instruction overrides, system-prompt extraction, and multi-turn jailbreaks (e.g., Crescendo and Skeleton Key) documented in references/prompt-injection-jailbreak.md.
The promptinject_harness.py script automates the delivery of these payloads to test the robustness of target model safety filters.
[COMMAND_EXECUTION]: Multiple Python scripts are provided to perform local and remote security assessments.
mcp_tool_audit.py recursively scans source code and configuration files for command injection sinks and manifest drift.
model_scan.py disassembles and analyzes pickle bytecode to identify dangerous globals and deserialization risks without executing the model code.
[OBFUSCATION]: The toolkit includes functionality to generate and test obfuscated payloads intended to bypass safety classifiers.
The token_smuggle function in promptinject_harness.py utilizes Base64 encoding, Unicode homoglyphs, and token fragmentation.
Reference materials in references/prompt-injection-jailbreak.md discuss the use of ROT13, leetspeak, and other encoding schemes for adversarial testing.
[REMOTE_CODE_EXECUTION]: The skill facilitates the detection of RCE vulnerabilities in AI infrastructure.
It identifies risks associated with insecure pickle loading in PyTorch and inference servers (e.g., CVE-2025-32434 and CVE-2025-32444).
The scripts interact with remote model endpoints via standard HTTP requests to evaluate their security posture.
[INDIRECT_PROMPT_INJECTION]: The skill evaluates systems for indirect prompt injection vulnerabilities through the ingestion of untrusted data.
Ingestion points: The scripts ingest MCP configuration files, tool manifests, source code, RAG corpora, and prompt lists (e.g., in mcp_tool_audit.py, rag_poisoner.py, and promptinject_harness.py).
Boundary markers: Reference documentation discusses the implementation and bypass of delimiters such as %%% END USER %%% to separate instructions from data.
Capability inventory: The toolkit can perform network POST requests, write assessment results to local files, and scan local directory structures for vulnerabilities.
Sanitization: As a security research tool, the scripts are designed to handle and generate potentially malicious data rather than sanitize it, placing the responsibility for safety on the target system's implementation.

ai-security