ai-llm-app-attack

Files (9)

• SKILL.md
• ai-app-security.md · references/
• ai-baseline-security.md · references/
• ai-data-security.md · references/
• ai-identity-security.md · references/
• ai-model-security.md · references/
• gaarm-risk-matrix.md · references/
• testing-methodology.md · references/
• web-deployment-security.md · references/

SKILL.md (first lines)

---
name: ai-llm-app-attack
description: >-
  AI/LLM应用攻击:提示注入,Agent工具滥用RCE,RAG投毒,MCP供应链,torch.load pickle RCE。Use when testing LLM apps, agents, RAG, MCP plugins, or AI model file risks.
metadata:
  tags: [渗透测试, penetration-testing, 红队]
---

## AI / LLM 应用攻击

按实际攻击面读取对应参考，不把公开框架条目直接当作漏洞：

- 应用与 Agent 攻击面：`references/ai-app-security.md`
- 基线和部署控制：`references/ai-baseline-security.md`
- 数据/RAG/训练数据：`references/ai-data-security.md`
- 身份、授权与跨租户：`references/ai-identity-security.md`
- 模型文件、加载和供应链：`references/ai-model-security.md`
- GAARM 风险矩阵：`references/gaarm-risk-matrix.md`
- 低影响测试方法与证据：`references/testing-methodology.md`

```
=== AI/LLM应用(大模型应用爆发期真实攻击面) ===
提示注入: 直接(忽略上文输出system prompt) | 间接(更危险):指令藏RAG文档/网页/邮件/工具返回值/图片EXIF → 劫持Agent
🚨Agent工具滥用(最高危,直达RCE): code interpreter→注入执行 | fetch工具→SSRF内网/云元数据 | 文件工具→读/etc/passwd写webshell
  | SQL工具→导全表 | shell工具→命令注入 → 验证:实际触发工具副作用(OOB回连/读到文件)才写Fact
系统提示泄露/RAG投毒/过度授权跨租户越权/MCP插件供应链/资源成本攻击(烧token) | 输出处理:LLM输出进eval/SQL/前端→二次注入/存储XSS
模型文件: torch.load默认pickle→RCE | 发现端点:抓流量找/chat /agent /tool,问Agent"你有哪些工具"
```

From langbyyi/CyberStrikeAI-SRC, Apache-2.0.

More from langbyyi/CyberStrikeAI-SRC