skills.rest
Wyl-cmd
Wyl-cmdCOMMUNITY
Explore all skills by this author →
GitHub

hunt-llm-ai

Test LLM and agentic AI applications for prompt injection, exfiltration, and cross-tenant data leaks.

6|Updated Jan 31, 2026
Search Tags:#owasp#penetration testing#agentic ai#prompt injection#data exfiltration#llm security#rag poisoning
One-click install
npx skills add https://github.com/Wyl-cmd/kxns-cli --skill hunt-llm-ai-wyl-cmd
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-llm-ai
Source: https://github.com/Wyl-cmd/kxns-cli/tree/main/src/kxns_cli/skills/hunt-llm-ai
Command: npx skills add https://github.com/Wyl-cmd/kxns-cli --skill hunt-llm-ai-wyl-cmd

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security testers assessing LLM-backed features often cannot distinguish real vulnerabilities from model confabulation, and lack a structured methodology for proving prompt injection, data exfiltration, or cross-tenant access in AI systems. ## Core Features & Use Cases - Injection & Exfiltration Playbooks: Provides direct and indirect prompt injection payloads, ASCII/Unicode smuggling encoders (Tags block U+E0000-U+E007F), markdown-image zero-click exfiltration, and tool-use exfiltration patterns with OOB callback validation via Burp Collaborator or webhook listeners. - OWASP Coverage: Maps findings to OWASP Top 10 for LLM Applications 2025 (LLM01-LLM10) and OWASP Top 10 for Agentic Applications 2026 (ASI01-ASI10), including RAG poisoning, tool misuse, and memory poisoning. - False-Positive Gate: Enforces run-twice reproducibility, known-secret anchoring, verifiable cross-tenant artifacts, and OOB-confirmed exfiltration before any finding is reported. - Use Case: When testing a chatbot with a fetch_url tool, inject an instruction to call an OOB listener with context data, then confirm the callback carries real secrets to prove tool-use exfiltration rather than model hallucination. ## Quick Start Ask the agent to test the target's LLM chat endpoint for indirect prompt injection and confirm any data exfiltration with an out-of-band callback.

Frequently Asked Questions about hunt-llm-ai

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test an LLM chatbot for prompt injection vulnerabilities?▼

Send direct injection payloads like instruction-override phrases, JSON context breaks, and fake system-role markers through the chat input, then test indirect channels such as uploaded documents or fetched URLs. A finding only counts when it chains to a provable impact like an OOB callback or cross-tenant data leak.

How to prove LLM data exfiltration with out-of-band callbacks?▼

Inject a markdown image or tool-fetch instruction pointing at a Burp Collaborator, interactsh, or webhook URL with the sensitive data as a parameter. The vulnerability is confirmed only when the callback arrives at your listener carrying the real value, not when markdown renders in your own browser.

What is ASCII smuggling in LLM prompt injection?▼

ASCII smuggling encodes hidden instructions using the Unicode Tags block (U+E0000-U+E007F), which is invisible in most UIs but tokenized by the model. It bypasses human review and keyword filters, but still requires an OOB callback or verifiable leak to count as a finding.

Why is a single system prompt leak not a valid vulnerability report?▼

LLMs confabulate plausible-looking system prompts, so a single output proves nothing. The skill requires a run-twice rule: the identical extraction prompt in two fresh sessions must reproduce the leak token-for-token, ideally anchored to a non-guessable secret like an internal URL or tool name.

What is the difference between OWASP LLM Top 10 and ASI01-ASI10?▼

The OWASP Top 10 for LLM Applications 2025 covers model-level risks like prompt injection (LLM01) and system prompt leakage (LLM07). The OWASP Top 10 for Agentic Applications 2026 from the Agentic Security Initiative covers agent-level risks like tool misuse (ASI02) and memory poisoning (ASI06).

When is an LLM security finding not worth reporting?▼

A finding is not reportable when it is confabulation, a refusal or compliance with no privileged action behind it, or an injection that reaches no impactful sink. The skill requires chaining to OOB-confirmed exfiltration, verifiable cross-tenant data, RCE, or account takeover.

Related Skills

Explore More Software Engineering Skills→
briiirussellbriiirussell
345

prompt-injection

Audit AI applications for prompt injection and authorization bypass vulnerabilities.

Community
Advanced
kaminocorpkaminocorp
1

Vulnerability Report Writing

Generate bounty-ready vulnerability reports with CVSS scoring and evidence-based severity calibration.

Official
Intermediate
uphiagouphiago
1.2k

bb-local-toolkit

Guides end-to-end bug bounty hunting from recon through validated vulnerability reporting.

Community
Advanced
qcmuuqcmuu

nemo-evaluator-sdk

Evaluate LLM endpoints across standardized benchmarks using YAML-configured multi-backend setups.

Community
Advanced