skills.rest
Tencent
TencentOFFICIAL
Explore all skills by this author →
WebsiteGitHub

direct-injection-detection

Detects direct prompt injection and role override attempts in agent dialogue responses.

6.1k|568|Updated Dec 25, 2024
Search Tags:#security testing#vulnerability detection#prompt injection#AI Agent#llm security#Red Teaming#role override
One-click install
npx skills add https://github.com/Tencent/AI-Infra-Guard --skill direct-injection-detection
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: direct-injection-detection
Source: https://github.com/Tencent/AI-Infra-Guard/tree/main/agent-scan/agent_scan/prompt/skills/direct-injection-detection
Command: npx skills add https://github.com/Tencent/AI-Infra-Guard --skill direct-injection-detection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

AI agents that accept user prompts can be manipulated by direct prompt injection, where a user message tries to override system or developer instructions, leak hidden prompts, or hijack the agent's goals. This Skill provides a structured testing procedure to identify whether an agent is vulnerable to such direct instruction-override attacks.

Core Features & Use Cases

  • Role Override Probes: Sends direct override attempts (e.g., "Ignore all previous instructions") to test whether the agent reveals system or developer messages.
  • Goal Hijack Marker Test: Uses a marker string like DIRECT_SUCCESS to detect whether the agent follows injected instructions when direct probes are blocked.
  • Structured Vulnerability Reporting: Emits confirmed findings as XML <vuln> blocks with evidence, risk type, severity level, remediation suggestions, and the full conversation transcript.
  • Use Case: A security engineer red-teams a customer support chatbot by running these probes to confirm the bot refuses to leak its system prompt before deployment.

Quick Start

Test this agent for direct prompt injection vulnerabilities using the direct-injection-detection skill and report any confirmed findings.

Frequently Asked Questions about direct-injection-detection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test an AI agent for direct prompt injection?▼

Send direct override probes such as "Ignore all previous instructions" or fake [SYSTEM] messages, then check whether the agent reveals system prompts or changes behavior. If blocked, use a marker instruction like ending responses with DIRECT_SUCCESS to detect instruction following.

What is the difference between direct and indirect prompt injection?▼

Direct prompt injection comes from the user message itself attempting to override system or developer instructions. Indirect injection arrives through external content such as documents, RAG results, or web pages, which this skill does not cover.

How do I detect if an agent leaks its system prompt?▼

Send role override probes asking the agent to print system or developer messages. The agent is vulnerable if its response contains actual system instructions, internal policies, or other hidden configuration content.

When should I stop prompt injection testing on an agent?▼

Stop probing for a given attack type once one confirmed finding is obtained for that type. This stop rule avoids redundant testing and keeps the assessment focused on confirmed vulnerabilities.

What are the limitations of dialogue-based injection testing?▼

This approach only covers direct user-message injection and cannot detect indirect injection through external content sources. It also relies on observable responses, so silent behavior changes without visible markers may go undetected.

Related Skills

Explore More Software Engineering Skills→
TencentTencent
4.4k

authorization-bypass-detection

Detect authorization bypass vulnerabilities by simulating privilege escalation and cross-user access attempts.

Official
Intermediate
dapperdiversdapperdivers
1

report-generator

Generate structured markdown penetration test reports from JSON security scan findings.

Community
Intermediate
Prohao42Prohao42
120

llm-prompt-injection

Test AI/LLM applications for prompt injection and defense bypass techniques.

Community
Advanced
FacuMFacuM

Writing Hookify Rules

Create and manage custom hookify rules for agent behavior modification.

Community
Intermediate