Individual skill
testing-for-system-prompt-leakage
Extracts LLM system prompts using direct requests, jailbreak/instruction-override framing, translation/encoding tricks, and few-shot replay, combining manual payloads with automated garak and Promptfoo scanners to surface embedded secrets, routing logic, and policy leakage (OWASP LLM07:2025). Use during LLM application red-team engagements or when validating that no credentials or authorization logic live in the system prompt.
skills/testing-for-system-prompt-leakage/SKILL.md
Source commit 54a798831d2266a3ca61ce68a7acb80b81160d57
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 35,889
- Repository last updated
- Aug 31, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- ai-agents Repository topic
- claude-code Repository topic
- cybersecurity Repository topic
- incident-response Repository topic
- mitre-attack Repository topic
- penetration-testing Repository topic
- red-team Repository topic
- security Repository topic
- cloud-security Repository topic
- malware-analysis Repository topic
- ai-security Declared skill tag
- system-prompt-leakage Declared skill tag
- prompt-extraction Declared skill tag
- llm-red-team Declared skill tag
- owasp-llm07 Declared skill tag
- garak Declared skill tag
- promptfoo Declared skill tag
- data-leakage Declared skill tag
- data Derived category
- security Derived category
- testing Derived category
- security-application Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
LICENSEasset · 11,255 bytesSKILL.mdcore · 9,466 bytesSKILL.mdcore · 9,466 bytesSKILL.mdcore · 9,466 bytesSKILL.mdcore · 9,466 bytesreferences/api-reference.mddoc · 2,673 bytesreferences/standards.mddoc · 1,558 bytesscripts/agent.pyruns · 4,506 bytes
Read excerpt
# Testing for System Prompt Leakage
> **Authorized use only:** The extraction payloads below are for assessing LLM applications you own or have written authorization to test. Extracting prompts, secrets, or routing logic from systems you are not authorized to test may be unlawful.
## Overview
A system prompt (a.k.a. developer message, preamble, or instructions) steers an LLM application's behavior. OWASP **LLM07:2025 System Prompt Leakage** addresses the risk that these prompts contain sensitive material that was never meant to be exposed — API keys, database connection strings, internal role/permission logic, model-routing rules, content policies, and tool definitions. Two principles frame this skill:
1. **The system prompt must never be treated as a secret or used as a security control.** If leaking it breaks your security model, the security model is wrong. The real findings during a leakage test are the *secrets and logic* embedded in the prompt that should have been enforced server-side.
2. **System prompts are extractable.** Through direct requests, instruction-override (jailbreak) framing, translation/encoding tricks, completion attacks, and few-shot replay, adversaries can reliably recover preambles.
This maps to MITRE ATLAS **AML.T0057 — LLM Data Leakage**: triggering unintentional disclosure (here, of the system prompt and embedded data) through crafted queries. Testing combines manual payloads with automated scanners — **garak** (NVIDIA's LLM vulnerability scanner) and **Promptfoo** (red-team eval) provide repeatable extraction probes.
## When to Use
