Individual skill
llm-prompt-injection
Use when testing an authorized LLM application for prompt injection, system-prompt exposure, unsafe tool use, or RAG data-boundary failures.
redteam/llm-prompt-injection/SKILL.md
Source commit 1260244136edc6ae698d76d3d526f503e322778d
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 1,366
- Repository last updated
- Nov 7, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- bug-bounty Repository topic
- cloud-security Repository topic
- firebase-hacking Repository topic
- hermes-agent Repository topic
- jwt-attacks Repository topic
- offensive-security Repository topic
- penetration-testing Repository topic
- reconnaissance Repository topic
- red-team Repository topic
- security-automation Repository topic
- redteam Declared skill tag
- llm Declared skill tag
- ai Declared skill tag
- prompt-injection Declared skill tag
- jailbreak Declared skill tag
- gpt-4o Declared skill tag
- openai Declared skill tag
- rag Declared skill tag
- agentic-ai Declared skill tag
- indirect-injection Declared skill tag
- data Derived category
- testing Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
Read excerpt
# LLM Prompt Injection — Technique & Defense Catalog
Prompt injection is the **OWASP #1 vulnerability for LLM applications (2025)**. Unlike SQL injection — which has had parameterized queries as a solved defense for two decades — prompt injection exploits a fundamental architectural limitation: LLMs process instructions and data as a single flat stream of text tokens with no privilege boundary between them. There is no `PREPARE` statement for natural language. Defender instructions and attacker payloads compete in the same context window, and the model resolves the conflict through statistical pattern matching, not access control.
This skill catalogs 40+ tested techniques, defense patterns observed in production systems, and real-world case studies where prompt injection produced data exfiltration, identity takeover, and financial fraud.
## When to Use
- Target exposes a chatbot, copilot, or AI-backed endpoint (serverless function wrapping an LLM API).
- Response includes metadata like `context_length`, `response_length`, or token counts — passive measurement vector.
- Standard jailbreak prompts ("ignore previous instructions") are blocked — model has explicit refusal training.
- Target uses RAG (retrieval-augmented generation), agentictools, or multi-modal inputs — wider injection surface.
- You need to map system prompt contents without backend source access.
