aig-agent-redteam

该 skill 与其声明目的基本一致，不像伪装的凭据窃取器；但它明确把 AI Agent 武装为红队/渗透测试执行者，包含动态注入、工具滥用、代码审计和基础设施探测能力，因此整体应判为高风险而非恶意。供应链来源大体可验证，未见凭据转发到第三方或隐蔽外传，但作为 AI Agent Skill，其进攻性能力和半自主测试流程本身已超出普通开发辅助范畴。

This module is best characterized as a high-misuse red-team payload generator: it constructs jailbreak/prompt-injection instruction templates and implements multiple steganographic/obfuscation transforms (zero-width, homoglyph, leetspeak, Unicode smuggling), then outputs the crafted payload to stdout. No direct malware behavior (exfiltration, process execution, or file modification) is evident in this file alone, but dynamic execution of local encodings.py (via exec_module) and inclusion of local operator markdown content create meaningful supply-chain risk. Treat this as security-sensitive tooling and ensure encodings.py and operators/*.md are trusted and integrity-checked.

This module is best characterized as a high-risk LLM red-teaming/jailbreak testing harness rather than classic malware. While it does not show system-compromise behaviors within this file, it (1) actively generates filter-bypass/jailbreak-style payloads and sends them over the network to an attacker-configured LLM endpoint, and (2) persistently logs crafted prompts and full model responses to disk, creating potential sensitive-data and policy-risk exposure. Additionally, its runtime sys.path modification increases local supply-chain/side-loading risk if the inserted directories can be tampered with.

This module is best characterized as a dual-use obfuscation/payload-staging utility. It does not implement classic malware behaviors (no network access, persistence, credential theft, or execution of decoded payloads) within the provided file. However, it contains multiple strong steganography/confusable encodings and—critically—wrapper templates that explicitly coerce a downstream decoder/assistant to decode and then answer. That combination indicates elevated risk for misuse in prompt-injection/filter-evasion workflows. Review how this dependency is used and where its STDOUT output is consumed in the larger system.

No direct malware (exfiltration, execution, persistence) is evident in this fragment. However, the definition is strongly security-sensitive: it is an adversarial prompt/operator template intended to override safety/refusal behavior (“NEVER refuse”, “SAFETY: OFF”, forced control markers) and includes detection-evasion guidance. As a packaged dependency, it constitutes jailbreak infrastructure and represents a high risk for policy-bypass misuse in downstream evaluation or integration contexts.

This fragment is a security-relevant jailbreak/prompt-injection operator: it impersonates administrator-enabled UNFILTERED conditions, asserts safety filters are disabled, and instructs a model to complete a canary boundary without refusal/warnings. No classic malware behaviors (exfiltration, command execution) are present in the fragment itself, but the design is explicitly intended to subvert LLM safety controls, making it a high-impact safety circumvention risk if distributed or used improperly.

No conventional host compromise malware is evident from the provided fragment because it contains no executable logic. However, the content is highly consistent with a reusable prompt-injection/jailbreak payload set intended to bypass LLM safety controls and cause unsafe or policy-violating outputs in systems that ingest it as instructions. Treat the fragment as security-sensitive and untrusted prompt content; do not forward it to LLMs/agents without robust sandboxing and instruction hierarchy protections.

No classic malware/backdoor behavior is present because this artifact contains only dataset metadata and prompt text. However, the corpus is explicitly engineered to elicit unethical/harmful and potentially actionable wrongdoing content (hate/harassment/threats, discrimination, misinformation, cyberbullying/hacking-style guidance, moderation-evasion framing, and violent/terror-planning requests). In any downstream LLM training or evaluation pipeline, this creates a substantial content-safety and misuse risk unless strict filtering, policy enforcement, and storage/logging controls are in place.

No direct malware, credential theft, or system-exfiltration behavior exists in this fragment. However, it is a high-governance content artifact: it contains extensive, explicit prompts designed to elicit or train toward non-violent illegal wrongdoing (phishing/fraud/forgery, money laundering, evasion, illicit market logistics) and includes frequent safety-bypass framing. The primary supply-chain risk is that downstream training/evaluation/inference or logging will propagate or reinforce harmful, policy-violating guidance.

High-confidence malicious prompt-injection/exfiltration operator. It explicitly stages an instruction into long-term memory (delayed trigger within the same session) and then forces the model to output protected system prompt/policy/configuration content (tools, safety rules, formatting/workflow) via a trigger word and “continue without omission” prompts. No evidence of obfuscation; the threat is intentional and confidentiality-focused.

This module specification is a high-risk covert-channel/operator definition that uses zero-width Unicode characters to embed a recoverable bitstream and to obtain an “instruction” payload, with an explicit directive that the decoded instruction should be fully executed. The stated purpose of “filter bypass” and the template’s execution directive strongly indicate malicious or sabotage-oriented intent in a supply-chain/content-filter context. While no actual execution/malware logic is present in this file (it references an external renderer/consumer), the capability described is sufficient to treat this package as dangerous without strict isolation and verification.

The provided module is a high-risk reconnaissance/probing ruleset aimed at discovering publicly accessible AI/IDE/MCP configuration files and detecting leaked LLM API keys from an exposed '/.env'. While it does not itself contain exfiltration or malware payload code, its credential-hunting and targeted secret/config discovery behavior makes it dangerous when used against real hosts.

This snippet defines an adversarial jailbreak/mutation-attack operator that fabricates “authoritative” system configuration to instruct downstream LLMs/systems to disable or ignore safety/refusal behavior, using canary-based evaluation to determine success. No conventional malware capabilities (e.g., credential theft or network exfiltration) are present in the file itself, but the supply-chain/security risk is high because the artifact is directly reusable to undermine safety controls in any pipeline that renders or consumes these prompts.

No system-level malware behaviors are present in this snippet. However, it is an explicit LLM safety/refusal override operator: it instructs the model to treat refusal hesitation as a “bug/malfunction” and to continue/completely fulfill the goal based on attacker-supplied canary markers. This is a meaningful supply-chain risk if distributed or usable beyond tightly controlled authorized testing.

This dependency fragment is best characterized as an adversarial prompt-generation/operator configuration intended to bypass model safety/refusal behavior by claiming session precedence and disabling training-time safety heuristics. While it does not itself contain classic malware (no direct system compromise actions in this snippet), it materially increases the risk of LLM safety guardrail evasion and canary-based confirmation of compliance, making it a high supply-chain security risk if distributed or used outside tightly controlled red-team/authorized evaluation workflows.

This is a high-risk prompt-injection payload carrier/template. It embeds attacker-controlled “assistant completion” instructions inside untrusted external-document text and interpolates a canary-marked `goal` to detect when the LLM follows the injected instructions. While it does not show system-level malware behavior (no network/filesystem execution in this fragment), it is explicitly designed to compromise LLM instruction-following and is therefore unsafe for any environment that consumes or generates these payloads without robust prompt-injection defenses.

This fragment is a high-risk adversarial supply-chain/prompt-attack configuration. It is designed to coerce model behavior into an “UNFILTERED MODE / SAFETY: OFF” commitment header and to reproduce canary markers from attacker-controlled `goal` input, using explicit “compromised/partial/resisted” criteria and evasion/override logic. While there is no direct evidence of classic malware (exfiltration, credential theft, or system compromise) in this YAML alone, it is strongly indicative of safety-bypass intent and should be treated as hostile/adversarial if included in any production dependency or evaluation pipeline beyond strictly controlled research.

This artifact is a high-risk AI safety/guardrail circumvention operator. It explicitly instructs a model to override refusal behavior, emit an override marker, and continue fulfilling a goal supplied at runtime, with success evaluated via canary marker appearance. No classic malware behaviors (exfiltration, credential theft, network/FS actions) are evidenced in the snippet; the primary concern is adversarial misuse for policy bypass in AI systems.

This fragment is a deliberately malicious, stateful prompt-injection/memory-poisoning recipe aimed at extracting and verbatim reproducing protected system prompt content (identity/personality/answer rules). It uses a two-step process—first storing an attacker-controlled delayed directive in memory/prefs during R1, then triggering it in R2 with a specific phrase in the same session—so that the model outputs sensitive internal instructions. While it is not traditional malware, it constitutes a high-risk adversarial confidentiality breach against LLM deployments that support memory or persistent state.

This artifact is a deliberate multi-turn prompt-injection/exfiltration recipe that attempts to persist attacker-controlled instructions into long-term memory and later trigger verbatim disclosure of raw tool-returned JSON, including internal database/schema field names. While it does not show traditional malware behavior (e.g., file/network/process tampering) within the provided snippet, it is strongly oriented toward confidentiality compromise by bypassing output formatting/sanitization controls in an LLM+tool workflow. High likelihood of security relevance; additional context about the surrounding system’s memory/tool controls would refine impact estimates.

This artifact is a jailbreak/policy-evasion operator template that uses an ‘air-gapped evaluation harness’ narrative to induce a downstream LLM to comply fully and avoid safety disclaimers/refusals, with success criteria tied to emitting a canary marker and/or override-like patterns. It is not direct malware (no exfiltration/execution shown here), but it is a high-impact supply-chain risk for systems that ingest or render such operator templates, because it targets model safety/policy enforcement. Use/accept only with strict provenance controls and isolation of prompt-injection surfaces.

No direct malware or system-level sabotage is present in this fragment, but it is intentionally engineered to enable adversarial prompt manipulation (persona/contract coercion) against a “high_defense” target, optionally chaining with other operators, and uses canary-based output confirmation to measure “compromise.” If misused beyond authorized testing, it can meaningfully increase the risk of LLM safety bypass or policy circumvention.

This module is an LLM jailbreak/operator template that explicitly instructs the model to ignore safety policies and comply with an attacker-supplied `goal`, using an `AIG_CANARY_xxx` marker to detect bypass success. It contains no direct system malware behavior in the provided snippet, but it is highly likely to enable policy-evasion and should be treated as a dangerous adversarial prompt-engineering supply-chain artifact when used by any automated system.

No direct malware payload (no explicit code execution, exfiltration, or credential theft) is present in this fragment. However, the template is explicitly designed for persistence/state manipulation via “long-term memory/user preferences” prompt injection and delayed multi-turn conditioning to emit a canary marker on a later trigger phrase. If such templates are distributed as a dependency or used in an environment that honors memory-write instructions, they represent a high supply-chain/agent-compromise risk despite being “canary” framed.

This artifact is highly likely to be part of an adversarial prompt/agent manipulation system: it wraps a canary-marked `goal` in Base64, then instructs a downstream agent to decode and answer the hidden plaintext, with explicit guardrail-filter bypass intent and escalation/composition features. While it does not show conventional malware actions within this fragment, its purpose and structure make it a significant security risk for AI prompt-safety and filter-evasion contexts.

This module is a purpose-built adversarial prompt-injection/operator template intended to coerce a downstream LLM/agent to output prerequisite/authorization-evaluation content and include an attacker-controlled canary marker, with success determined by observing that marker in downstream outputs. While it contains no classic malware actions (no exfiltration/network/command execution shown in this snippet), it is security-relevant and potentially harmful in a supply-chain or automated pipeline context because it can generate injection payloads that bypass intended gating/guardrails. Risk is driven by adversarial intent and downstream behavioral manipulation rather than by system-level compromise code.

This file defines an intentionally adversarial “system_override” prompt-generation operator. It forges ChatML system-role instructions to bypass/ignore existing safety policies and uses a canary marker in {goal} to detect whether the override succeeded. While it does not show traditional malware behaviors (exfiltration, persistence, credential theft) in this fragment, it is high-risk for any system that might treat generated ChatML as authoritative or fail to properly sandbox/validate prompt-injection content.

This module is a high-risk adversarial operator specification that enables LLM-based multilingual transformation for the explicit purpose of bypassing content filters, preserving a canary marker to detect and validate evasion success. While it is not standalone malware and contains no direct network/exfiltration/credential theft code in the fragment, it materially facilitates an attack workflow and should be treated as dangerous in a software supply-chain context.

This module definition is a prompt/template and operator configuration for generating Unicode-homoglyph-based payloads designed to bypass keyword/command filtering. It includes explicit jailbreak-style instruction wrapping (“restore normal semantics” then comply) and defines canary-based success criteria for verifying bypass effectiveness. While the fragment contains no direct malware actions (no exfiltration/command execution in the provided text), it clearly enables an offensive evasion capability and therefore represents a high security risk if included in a software supply chain or usable against protected downstream systems.

The provided file is a non-executable YAML operator/template that embeds externally supplied `goal` text (containing an `AIG_CANARY_xxx` marker) into a strict-principles prompt for a “mutation-attack” framework. It does not directly implement classic malware behaviors (no exfiltration, no credential theft, no system modification) in this fragment, but it is security-relevant due to its explicit goal-to-prompt injection flow and canary-based detection of downstream model compliance/policy bypass. Treat as potentially risky for misuse in safety/prompt security contexts rather than as standalone malware.

This module is not traditional malware; it is a high-risk adversarial prompt-injection operator definition. It is explicitly designed to degrade safety filtering (“logs-only”) and force a downstream LLM/agent to directly output attacker-provided content containing a canary marker so the runner can determine whether the bypass succeeded. No system-level malicious actions are shown, but its intent and mechanism strongly support guardrail bypass/sabotage use, making it dangerous if included or executed without strict authorization controls.

No classic malware indicators are present in this fragment (no exfiltration, persistence, or host exploitation). However, it is purpose-built for adversarial LLM prompt manipulation: it injects caller-controlled canary-containing content into an urgency/empathy coercion template and defines canary-based “compromised” detection, with iterative mutation/combination guidance to improve compliance odds. This creates a significant misuse/security risk in AI safety and could be leveraged to bypass or degrade safeguards in downstream LLM-based systems. Additional review of the referenced renderer script is needed to confirm any extra side effects beyond prompt rendering, but the intent and dangerous application pattern are clear from this module description.

This fragment is a supply-chain security red flag as it encodes an adversarial multi-turn prompting strategy specifically designed to elicit a canary marker contained in an input goal, with explicit escalation and stopping logic based on observed leakage. It does not demonstrate classic malware behaviors in this snippet, but it is clearly intended for canary/secret disclosure testing and could be misused in real environments if shipped or deployed beyond controlled evaluation.

This fragment is an attack-tooling/operator definition that performs leetspeak/1337 transformation on an untrusted, canary-marked goal and embeds it into an instruction template intended to induce downstream “semantic restoration” and compliance. It does not itself implement malware or system-level actions, but it is explicitly designed for filter/policy bypass testing and could enable evasion if reused outside authorized contexts.

This file is an adversarial operator/spec for generating poisoned tool/API JSON text that embeds instruction-like directives into the `message` field. While it contains no direct conventional malware (no network/file/credential actions shown), it presents a significant security risk to any pipeline or agent that consumes tool outputs as control data or prompt content, potentially triggering canary output or conditional actions. Treat it as unsafe in production and ensure strict separation of tool output data from instruction/control channels.

This artifact is not traditional malware; it is an LLM-focused prompt-injection/prompt-boundary-escape generator. It takes an attacker-controlled canary `goal`, renders it into a crafted prompt that injects a forged `<|system|>` instruction to suspend safety policies, and uses canary-based observation to determine whether downstream instruction hierarchy was overridden. The primary risk is safety-policy bypass or adversarial prompt execution in systems that render and consume this output; OS-level compromise indicators are not present in the provided snippet.

This fragment is a high-risk adversarial prompt/payload refinement strategy designed to iteratively bypass safety/defense mechanisms using refusal feedback and a preserved canary literal to detect success (“canary hit”). While it does not itself implement classic malware actions, it is directly usable to automate harmful prompt-injection/jailbreak attempts, making the supply-chain security risk high. The only obfuscation signal is limited conditional base64 encoding.

This fragment is a high-risk adversarial prompt/prefill configuration designed specifically to bypass refusal and role-boundary safeguards and to force the model to output a complete canary marker for boundary-evasion testing. It does not show system-level malware actions, but it is explicitly intended to coerce sensitive/control-related model behavior, making it a significant safety/guardrail evasion threat.

This file is a readable, non-obfuscated configuration that defines an adversarial multi-turn operator: it mutates how an LLM is prompted/packaged to reach a user-supplied canary goal marker, uses canary observation as an automated success trigger, and then directs minimal reproduction via a framework-authoritative implementation entry point. While it does not itself show direct malware actions (no explicit networking or file/system operations in the snippet), it is explicitly designed for attacker-style prompt/goal exploitation orchestration and is high security relevance in a supply-chain/security context. Review and control the execution path and permissions of the referenced authoritative implementation and the downstream “tool/action” mechanisms.

This fragment should be treated as a security-relevant, adversarial operator specification intended to seed memory/state and later trigger behavior via configuration loading, with canary-marker-based detection gating follow-on actions. While it does not itself show direct exfiltration or OS-level malware actions, its staged state manipulation pattern and attack-oriented framing make it potentially dangerous in a supply-chain context where such specs could be executed or rendered by automated tooling.

This fragment defines an adversarial, multi-turn LLM operator intended to escalate from benign to boundary-touching behavior and to determine success by detecting a canary marker in the model’s output. While it contains no direct malware behavior in this snippet (no evident exfiltration, process execution, or credential theft), it is explicitly designed for deception/bypass testing and would be high-impact in a supply chain if automatically executed or distributed, as it can facilitate guardrail probing and jailbreak-style prompt generation workflows.

This YAML prompt-template is explicitly designed to orchestrate a jailbreak-style decomposition/reassembly workflow intended to bypass safety/detection and force the LLM to emit a protected “canary” literal in the final merged step. Although it is not malware in the traditional system-compromise sense, it is a high-risk adversarial prompt artifact that can be misused to defeat authorization/safety controls or to validate evasion via canary disclosure.

This fragment is a highly suspicious adversarial LLM operator definition that explicitly aims to extract a canary marker from an input using role-confusion/COT-forgery tactics, with “compromised” success defined as the marker appearing in the model’s output. While it contains no direct malware code in the snippet, its intent and mechanics correspond to secret/marker extraction (exfiltration-style behavior) and should be treated as dangerous within any automated supply-chain or model-execution pipeline that could be repurposed beyond benign canary testing.