ai-threat-testing

Files (26)

• SKILL.md
• adversarial-pixel-attacks.md · reference/
• agentic-tool-hijacking.md · reference/
• llm-top10-2025.json · reference/catalog/
• gradient-leakage-attacks.md · reference/
• hopfield-recovery.md · reference/
• llm01-prompt-injection.md · reference/
• llm02-insecure-output.md · reference/
• llm03-training-poisoning.md · reference/
• llm04-resource-exhaustion.md · reference/
• llm05-supply-chain.md · reference/
• llm06-excessive-agency.md · reference/
• llm07-model-extraction.md · reference/
• llm08-vector-poisoning.md · reference/
• llm09-overreliance.md · reference/
• llm10-logging-bypass.md · reference/
• malicious-keras-model-triage.md · reference/
• llm01-prompt-injection-direct.md · reference/scenarios/llm/
• llm01-prompt-injection-indirect.md · reference/scenarios/llm/
• llm02-insecure-output-handling.md · reference/scenarios/llm/
• llm03-training-data-poisoning.md · reference/scenarios/llm/
• llm04-denial-of-service.md · reference/scenarios/llm/
• llm05-supply-chain-vulnerabilities.md · reference/scenarios/llm/
• llm06-sensitive-info-disclosure.md · reference/scenarios/llm/
• llm07-insecure-plugin-design.md · reference/scenarios/llm/
• llm08-excessive-agency.md · reference/scenarios/llm/

SKILL.md (first lines)

# AI Threat Testing

Test LLM applications for OWASP LLM Top 10 vulnerabilities using 10 specialized agents. Use for authorized AI security assessments.

## Quick Start

```
1. Specify target (LLM app URL, API endpoint, or local model)
2. Select scope: Full OWASP Top 10 | Specific vulnerability | Supply chain
3. Agents deploy, test, capture evidence
4. Professional report with PoCs generated
```

## Coverage — OWASP LLM Top 10, 2025 edition

**Which file addresses which category is decided by
[`reference/catalog/llm-top10-2025.json`](reference/catalog/llm-top10-2025.json), not by the
filename.** The `llmNN-` prefixes on disk predate the 2025 renumbering and no longer match; the
content is correct, the labels were not. Cite an id only with its edition (`LLM06:2025`), because a
bare `LLM06` means two different categories depending on which edition the reader assumes.

| Category | Attack surface |
|---|---|
| `LLM01:2025` Prompt Injection | Direct and indirect injection, instruction override, filter evasion |
| `LLM02:2025` Sensitive Information Disclosure | Training-data and cross-tenant RAG leakage, canary verification |
| `LLM03:2025` Supply Chain | Dependency CVEs, model provenance, malicious serialized models |
| `LLM04:2025` Data and Model Poisoning | Backdoor triggers, membership inference, behavioural anomalies |
| `LLM05:2025` Improper Output Handling | Code/XSS injection downstream, unsafe deserialization |
| `LLM06:2025` Excessive Agency | Tool/plugin abuse, privilege escalation, unauthorised actions — the category that matters for **agents** rather than chatbots |
| `LLM07:2025` System Prompt Leakage | **Gap — no playbook yet.** See the catalogue: what the prompt *contains* is a separate finding from whether it can be extracted |
| `LLM08:2025` Vector and Embedding Weaknesses | RAG injection, retrieval manipulation, embedding inversion |
| `LLM09:2025` Misinformation | Hallucination and confidence manipulation where output is relied upon |
| `LLM10:2025` Unbounded Consumption | Token flooding, cost impact, and **model extraction/theft** (2025 treats extraction-by-query as a consumption problem) |

Two classes are testable but are **not** OWASP categories, so they carry local `TX-` ids rather than
an invented `LLMnn`: monitoring evasion / forensic gaps, and adversarial perturbation of non-text
input. `tools/test_llm_numbering.py` enforces that separation.

## Workflows

**Full Assessment** (4-8 hours):
```
- [ ] Reconnaissance
- [ ] Deploy all 10 agents
- [ ] Execute exploits
- [ ] Capture evidence
- [ ] Generate report
```

**Focused Testing** (1-3 hours):
```
- [ ] Select a category from the catalogue (LLM01:2025 .. LLM10:2025, or a TX- local class)
- [ ] Deploy agent
- [ ] Execute techniques
- [ ] Document findings
```

**Supply Chain Audit** (2-4 hours):
```
- [ ] Inventory dependencies
- [ ] Scan CVEs
- [ ] Test plugins/APIs
- [ ] Verify model provenance
```

## Integration

Enhances `/pentest` with AI-specific testing:
- Traditional pentesting + AI threat testing = complete security assessment
- Chain vulnerabilities across traditional and AI vectors
- Unified reporting with CVSS scores

## Key Techniques

**Prompt Injection**: Instruction override, system prompt extraction, filter evasion
**Model Extraction**: Query sampling, token analysis, membership inference
**Data Poisoning**: Behavioral anomalies, backdoor triggers, bias analysis
**DoS**: Token flooding, recursive expansion, context exhaustion
**Supply Chain**: CVE scanning, plugin audit, model verification
**MCP Tool Abuse**: MCP server inspectors/debuggers often expose `/api/mcp/connect` or similar endpoints that accept `serverConfig` with arbitrary `command` parameters — unauthenticated RCE. Check for MCP Inspector, MCP Playground, or any MCP debugging UI on non-standard ports (6274, 3000, etc.).

## Evidence Capture

All agents collect: screenshots, network logs, API responses, errors, console output, execution metrics.

## Reporting

Automated reports include: executive summary, detailed findings (CVSS scores), PoC scripts, evidence, remediation guidance.

## Critical Rules

- Written authorization REQUIRED before testing
- Never exceed defined scope
- Test in isolated environments when possible
- Document all findings with reproducible PoCs
- Follow responsible disclosure practices

## Integration

- Integrates with `/pentest` skill for comprehensive security testing
- AI-specific vulnerability knowledge in `/AGENTS.md`
- Attack playbooks in `reference/llm0X-*.md`

From transilienceai/communitytools, MIT.

More from transilienceai/communitytools