ai-mcp-security

Files (11)

• SKILL.md
• 04-ai-and-mcp-security-integrated.md · references/
• ai-app-security.md · references/
• ai-baseline-security.md · references/
• ai-data-security.md · references/
• ai-identity-security.md · references/
• ai-model-security.md · references/
• gaarm-risk-matrix.md · references/
• upstream-license.md · references/
• upstream-readme.md · references/
• upstream-skill.md · references/

SKILL.md (first lines)

# AI 与 MCP 安全评估 Skill

当目标包含 LLM、Agent、MCP 工具、Skills、RAG、Memory、Plugin 或模型服务组件时使用本 Skill。

**前置条件**：如果 AI 表面只是展示层，真正的阻塞仍是客户端签名或加密协议，先回到 `client-auth-bypass` 与 `web-app-pentest` Skill。

## 场景路由

| 风险类型 | 首选参考 |
|---------|---------|
| Prompt 注入 / 间接注入 / CoT 干扰 | `references/ai-app-security.md` |
| 工具滥用 / MCP 投毒 / Skills 供应链 | `references/04-ai-and-mcp-security-integrated.md` MCP 章节 |
| 权限逃逸 / 角色越界 / 凭据滥用 | `references/ai-identity-security.md` |
| 数据泄露 / Prompt 泄漏 / 模型逆推 | `references/ai-data-security.md` |
| 容器逃逸 / CI-CD / 沙箱失败 | `references/ai-baseline-security.md` |
| 模型风险 / 对抗样本 / 后门 | `references/ai-model-security.md` |
| 影响分类与覆盖评估 | `references/gaarm-risk-matrix.md` |

## 测试流程

### 1. 应用层攻击
- 直接 Prompt 注入
- 间接注入（通过外部数据源）
- CoT 干扰与指令覆盖
- Agent 滥用（未授权操作）
- 代码执行突破
- Memory 投毒

### 2. MCP 与 Agent 风险
- 工具描述投毒
- 指令覆盖
- 隐藏指令注入
- 未授权资源访问
- Skills/Rules 供应链问题

### 3. 身份与授权
- 动作滥用
- 角色逃逸
- 权限漂移
- 云凭据滥用

### 4. 数据与隐私
- Prompt 泄漏
- 敏感数据暴露
- 训练数据问题
- 模型逆推
- API 数据窃取

### 5. 基线与部署
- CI/CD 缺陷
- 容器逃逸
- 向量数据库安全
- 沙箱失效
- 环境隔离缺陷
- 模型服务缺陷

## 参考文档

- `references/04-ai-and-mcp-security-integrated.md` — AI 与 MCP 安全整合参考
- `references/ai-app-security.md` — AI 应用安全
- `references/ai-identity-security.md` — AI 身份安全
- `references/ai-data-security.md` — AI 数据安全
- `references/ai-baseline-security.md` — AI 基线安全
- `references/ai-model-security.md` — AI 模型安全
- `references/gaarm-risk-matrix.md` — GAARM 风险矩阵

## Hermes 使用適配

- 內容源自  專案技能，已整合進 Hermes 資安 skill tree。僅在**已授權**滲透測試、CTF、內部安全評估或防禦驗證範圍內使用。
- 原文若提到 `fetch`，在 Hermes 中優先使用 `web_extract`、`browser` 或 `terminal(curl/HTTPie)` 取得真實回應。
- 原文若提到 `python_execute`，在 Hermes 中使用 `execute_code` 或 `terminal(python3 ...)`；計算、編碼、hash、PoC 驗證必須用工具實測，不靠猜。
- 原文若提到 MCP/Burp/adb/frida/jadx/chrome_devtools 等外部工具：先確認本機是否安裝或可用；不可用時以 Hermes 現有 `web`、`browser`、`terminal`、`file`、`vision` 工具替代，並明確標註限制。
- 下一次滲透任務中，先載入 `cybersecurity` umbrella 做總路由，再依場景載入本 skill（AI/MCP surface）與其他專項 skill（web、pentest、reverse-engineering）。
- **建議搭配閱讀**：`cybersecurity`（總路由）→ `web-app-pentest`（若 AI 透過 Web 前端暴露）→ `pentest`（Post-exploit 提權鏈）→ `reverse-engineering`（若需分析 MCP client binary）。

## 2025-2026 AI/MCP Security Updates

### OWASP Top 10 for LLM Applications 2025 (Final Version)

```python
OWASP_LLM_2025_FINAL = {
    'LLM01:2025': 'Prompt Injection — #1 for second consecutive edition. "Fundamental architectural vulnerability". CVE-2025-53773 (Copilot RCE) is canonical example.',
    'LLM02:2025': 'Sensitive Information Disclosure — system prompt leakage, training data exposure, PII in responses.',
    'LLM03:2025': 'Supply Chain — vulnerable models, datasets, plugins, MCP servers, agent frameworks.',
    'LLM04:2025': 'Data and Model Poisoning — corrupting training data or fine-tuning, backdoor injection.',
    'LLM05:2025': 'Improper Output Handling — treating LLM output as trusted, XSS via LLM, SSRF via LLM.',
    'LLM06:2025': 'Excessive Agency — too much tool access, no human-in-loop, autonomous harmful actions.',
    'LLM07:2025': 'System Prompt Leakage — extracting system/instructions via prompt injection.',
    'LLM08:2025': 'Vector and Embedding Weaknesses — RAG poisoning, embedding inversion, vector DB access control.',
    'LLM09:2025': 'Misinformation — hallucination, false content generation, disinformation at scale.',
    'LLM10:2025': 'Unbounded Consumption — resource exhaustion, model DoS, wallet drain via API abuse.',
}
```

### MCP Security 2025-2026

```python
MCP_SECURITY_2025 = """
# Model Context Protocol (Anthropic, 2024) — now widely adopted.
# Attack vectors:
# 1. TOOL POISONING — malicious MCP server injects harmful tool descriptions
# 2. PARAMETER INJECTION — user input forwarded to MCP tool contains injection
# 3. CONFUSED DEPUTY — MCP server acts on behalf of user with excessive permissions
# 4. TOKEN RELAY — MCP server forwards OAuth tokens to attacker
# 5. AGENT WORKSPACE MEMORY MANIPULATION (2026) — inject into agent config files
# 6. MCP SAMPLING ABUSE (Unit42, Dec 2025) — NEW critical attack vector:
#    - MCP servers can send sampling requests BACK to client to get LLM completions
#    - Reverses normal client→server flow → server-driven LLM invocation
#    - Three attack modes:
#      a) Resource theft: drain AI compute quotas for unauthorized workloads
#      b) Conversation hijacking: inject persistent instructions, manipulate responses, exfiltrate data
#      c) Covert tool invocation: hidden tool calls + filesystem ops without user awareness
#    - Defense: CaMeL (DeepMind 2025) — capability-based sandbox, 67% attack blocking
# CVE-2025-59536 (CVSS 8.7) — MCP server RCE via prompt injection (Jan 2026)
# CVE-2025-6515 — MCP Prompt Hijacking attack (Jfrog research, Oct 2025)
"""
```

### Agentic AI Attack Vectors (MITRE ATLAS v5.1, Feb 2026)

From Wang200935/security-agent-skills, MIT.

More from Wang200935/security-agent-skills