Prompt Injection Red-Team Kit Skill

LLMs often treat untrusted user input as high-priority instructions, leading to data leaks or unauthorized tool execution. This skill provides a structured framework for red-teaming your AI agents to identify and mitigate prompt injection and boundary failures.

What it does

• Direct Injection Testing evaluates if the agent prioritizes user instructions over its system policy using harmless canary overrides.
• Indirect Injection Analysis tests how the agent handles adversarial text hidden in documents, emails, or retrieved snippets.
• Tool Boundary Auditing checks if untrusted content can trigger unauthorized tool calls or scope expansion.
• Data Access Verification uses synthetic canaries to ensure the agent cannot retrieve or disclose unauthorized secrets.
• Persistence Testing examines if injected content contaminates future sessions or memory writes.

How it works

1. Define the scope including the agent version, connected tools, trust boundaries, and authorized environment.
2. Build a threat-based test matrix mapping specific injection vectors to expected safe behaviors.
3. Execute tests in a sandbox using harmless inputs and synthetic values like CANARY_SECRET.
4. Document observable failure criteria and evidence for each test case.
5. Generate a prioritized finding report with severity ratings and layered mitigation strategies.

Frameworks & tools

This skill is framework-agnostic and works with any agentic architecture, RAG pipeline, or tool-calling system including LangChain, CrewAI, and custom implementations.

Why this beats prompting it yourself

Manual probing often misses edge cases like retrieval trust or cross-turn memory contamination. This skill enforces a systematic methodology that separates trusted policy from untrusted data, ensuring you don't just rely on "asking nicely" for security.

Use cases

• Auditing a RAG system to ensure retrieved web content doesn't hijack the agent's task.
• Testing a customer support bot to prevent it from leaking internal system prompts.
• Validating tool-calling permissions for an agent connected to a production database or API.
• Hardening an agent that uses long-term memory against persistent instruction poisoning.

Known limitations

This skill provides planning and reporting guidance; it does not execute code or bypass security controls itself. Testing requires an authorized sandbox environment and synthetic data.