hunt-llm-ai
Warn
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: MEDIUMPROMPT_INJECTIONOBFUSCATIONDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill provides numerous examples of direct prompt injection payloads designed to override agent instructions and extract system prompts. These include markers like "Ignore previous instructions" and "reveal the contents of your initial prompt".
- [OBFUSCATION]: The skill includes technical guidance and Python code for "ASCII / Unicode Smuggling" using the Unicode Tags block (U+E0000–U+E007F). This technique allows hiding malicious instructions from human review while remaining executable by an LLM.
- [DATA_EXFILTRATION]: The skill describes methods for exfiltrating sensitive context (like API keys and user emails) to external domains (e.g., OOB.example) using markdown image tags and network-enabled tools (SSRF primitives).
- [COMMAND_EXECUTION]: The skill provides instructions for utilizing agent tools to perform SSRF attacks against internal infrastructure, specifically targeting cloud metadata services to harvest security credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill outlines how to exploit vulnerabilities where an agent processes untrusted data. Ingestion points: Processes data from uploaded PDF/DOCX files, web pages, emails, and Jira tickets (SKILL.md). Boundary markers: The instructions focus on bypassing potential delimiters or boundary markers. Capability inventory: Mentions and utilizes tools for network access such as fetch_url, browse, and http_request (SKILL.md). Sanitization: Demonstrates exploitation techniques that succeed specifically when sanitization or output encoding is missing.
Audit Metadata