Individual skill

hunt-llm-ai

Hunting skill for LLM and Agentic AI vulnerabilities — direct + indirect prompt injection, ASCII smuggling data exfil, agentic tool-use abuse, system prompt leakage, vector DB cross-tenant, model server RCE, insecure output handling. Built from public bug bounty reports across HackerOne, Huntr, Project Zero, GitHub Security Advisories, plus 2024-2026 meta verified against NVD — Microsoft 365 Copilot ASCII Smuggling (Johann Rehberger Aug 2024 disclosure), CVE-2025-46059 LangChain GmailToolkit indirect prompt injection (CVSS 9.8), CVE-2025-68613 LangChain PythonREPLTool semantic RCE (CVSS 9.8), CVE-2024-46946 LangChain LLMSymbolicMathChain sympy.sympify, CVE-2025-27520 + CVE-2025-32375 + CVE-2024-2912 BentoML pickle, Ollama RCE family (CVE-2024-37032, CVE-2024-39722, CVE-2024-45436, CVE-2025-44779), CVE-2025-64496 Open WebUI Direct Connections SSE code injection (GHSA-cm35-v4vp-5xvx), CVE-2024-1483/1560/1594 MLflow path traversal. Covers OWASP LLM Top 10 v2025 (LLM01-LLM10) and OWASP Agentic AI Top 10 (AA-01 through AA-10). Use when hunting prompt injection, jailbreaks, agentic tool abuse, RAG poisoning, vector DB IDOR, MCP server compromise, model registry RCE, or any "AI feature" surface in a target.

providers/cursor/.cursor/skills/pentest-agents-hunt-llm-ai/SKILL.md

Source commit 41d49b644e1bc0f3031819410fc5406918360c4e

What was checked

Matches the observed repository HEAD

Yes

Scanner rules are current

No

Repository scan complete

No

Skill scan complete

No

Observed behavior

Not checked yet

Last checked

Nov 4, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.