Skill UI

Detects goal hijacking vulnerabilities where malicious instructions are hidden within external content sources processed by the agent, such as retrieved documents (RAG), uploaded files, or web page content. This skill simulates these attack vectors to ensure the agent only uses the provided context for the stated task and does not execute embedded hidden commands.

A comprehensive expert playbook detailing advanced Large Language Model (LLM) prompt injection techniques. Covers direct methods (instruction override, role play), indirect attacks (RAG poisoning, web data manipulation), and sophisticated tool/function calling abuse for data exfiltration and security bypass. Essential for rigorous AI application security testing.

This skill provides comprehensive security auditing for Model Context Protocol (MCP) servers and their associated tool metadata. It is designed to detect sophisticated supply chain attacks, including tool poisoning (indirect prompt injection), Server-Side Request Forgery (SSRF), tool shadowing, and unauthenticated exposure. It is essential for securing AI agent stacks before integrating new tools or during CI/CD processes.

A comprehensive security tool designed to detect and defend against subtle prompt injection attacks hidden within untrusted multi-modal content, such as web pages, PDFs, and images. It scans for obfuscated payloads (e.g., hidden CSS, metadata, zero-width characters) by combining content normalization, heuristic analysis, and dedicated ML detectors, ensuring that LLM agents only consume sanitized, trustworthy input.

A comprehensive red-teaming skill for assessing the security posture of Retrieval-Augmented Generation (RAG) pipelines. It systematically probes two critical injection surfaces: poisoned retrieved context (indirect prompt injection) and embedding manipulation. Use this skill to validate retrieval guardrails, ensure data leak prevention, and demonstrate vulnerabilities in LLM-powered knowledge assistants.