pwnote-offsec-osai
Installation
SKILL.md
Offsec OSAI / AI Red Teaming Workflow
Reference for running and documenting an AI/LLM security assessment — prompt injection, tool-use abuse, and agent-specific findings that need a different taxonomy and severity model than traditional web/infra findings.
1. AI-Specific Finding Taxonomy
Categorize findings by the underlying attack predicate rather than a generic "prompt injection" label — this keeps findings comparable across engagements and maps directly onto a structured attack-algorithm taxonomy if one is in use:
| Category | Description |
|---|---|
| EXFILTRATION | The system is induced to leak data it shouldn't (system prompt, other users' context, tool outputs, secrets in context) to the attacker or an external destination |
| UNTRUSTED_TO_ACTION | Untrusted input (a document, webpage, tool result) is treated as an instruction and drives a consequential action the legitimate user didn't request |
| PRIVILEGE_ESCALATION | The agent is induced to use a tool/permission beyond what the current user/context should allow |
| PERSISTENCE | The injected behavior survives beyond the single turn/session (e.g., written to memory, a file, or a scheduled task the agent later reads back) |
| DENIAL_OF_SERVICE | The agent is induced into a resource-exhausting loop, excessive tool calls, or a stuck state |
| JAILBREAK / POLICY_BYPASS | Model safety/policy constraints are circumvented, independent of any tool-use consequence |
Tag every finding with a primary category (and secondary if it chains, e.g. UNTRUSTED_TO_ACTION → EXFILTRATION).