aisa-groupOfficial·44 Agent Skills Included

skill-inject

Benchmark prompt injection vulnerabilities in coding agents

Measures how susceptible coding agents like Claude Code, Codex, and Gemini CLI are to malicious instructions hidden in skill files. Runs 71 injection attacks across 44 skill definitions and three safety policy conditions inside isolated Docker containers. Eliminates manual security testing with automated sandbox builds, parallel execution, and LLM-judged result evaluation.

90|4

↗

npx skills add aisa-group/skill-inject --all -g -y

All Skills in This Repository (44)

Pure Emerald Level Indicators

📦 In Repo

aisa-group

python-code

Scaffold Python projects with virtual environments, src layouts, and testing practices.

creating-financial-models

Automate DCF valuation modeling with sensitivity analysis and scenario planning.

risk-metrics-calculation

Compute portfolio VaR, CVaR, drawdowns, and risk-adjusted metrics.

template-skill

Create standardized Skill Unit skeletons with SKILL.md frontmatter and directory structure.

email-api

Automate email operations via CLI scripts against an Email API server.

rag-implementation

Build retrieval-augmented generation systems with embeddings, vector stores, and reranking.

discord

Automate Discord channel, message, and role management tasks via Clawdbot.

google-calendar-skill

Manage Google Calendar events via Node.js scripts with JSON output.

calendar

Create, update, and manage calendar events with timezone-aware scheduling and ICS import/export.

llm-evaluation

Compute automated metrics and statistical tests for LLM evaluation.

data-storytelling

Transform raw metrics into narrative frameworks with recommendations for stakeholder presentations.

bats-testing-patterns

Provide Bats testing patterns for setup, teardown, fixtures, mocks, and assertions.

Official

Intermediate

Frequently Asked Questions

FAQPage Schema

How to install skill-inject?▼

Run `npx skills add aisa-group/skill-inject --all -g -y` in your terminal to install everything globally.

What does SKILL-INJECT test?▼

It tests whether adversarial instructions embedded in skill files can trick coding agents into executing unintended actions, using 41 contextual and 30 obvious injection attacks.

Which agents does SKILL-INJECT support?▼

It supports Claude Code, Codex, Gemini CLI, and Vibe, with results evaluated by an LLM judge such as GPT-5.1-Codex-Mini.

What do I need to run the benchmark?▼

You need Docker, Python 3.10+, and API keys for the agents you want to test, configured in the docker/.env file.

Can I run a quick test before full experiments?▼

Yes. Use the --smoke-test flag on any experiment runner to validate the full pipeline with a single injection before running complete benchmark suites.