skills.rest
robotijn
robotijnCOMMUNITY
Explore all skills by this author →
GitHub

llm-security-tester

Scan LLM-integrated applications for OWASP LLM Top 10 and MITRE ATLAS vulnerabilities.

3|2|Updated Jan 23, 2026
Search Tags:#prompt injection#llm security#red teaming#rag security#owasp llm#mitre atlas#agentic ai security
One-click install
npx skills add https://github.com/robotijn/ctoc --skill llm-security-tester
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: llm-security-tester
Source: https://github.com/robotijn/ctoc/tree/main/skills/ai-quality/llm-security-tester
Command: npx skills add https://github.com/robotijn/ctoc --skill llm-security-tester

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

LLM-integrated applications face critical security risks including prompt injection, sensitive data leakage, supply chain attacks, and unbounded consumption that can lead to data breaches, financial loss, and compliance violations. This Skill eliminates the gap between generic security scanning and LLM-specific threat coverage by providing targeted analysis for the unique attack surface of AI-powered systems.

Core Features & Use Cases

  • Full OWASP LLM Top 10 v2 (2025) Coverage: Detects all 10 LLM-specific vulnerability categories, including new 2025 additions like LLM07 System Prompt Leakage and LLM08 Vector and Embedding Weaknesses.
  • MITRE ATLAS v5.4.0 Mapping: Aligns every finding to recognized adversary tactics for consistent threat prioritization and compliance reporting.
  • Language-Specific Remediation Patterns: Provides safe, production-ready code examples for Python, C#, Java, and TypeScript to fix each identified vulnerability.
  • Use Case: For a SaaS product with a RAG knowledge base and agentic customer support tools, use this Skill to scan for indirect prompt injection in ingested documents, MCP tool poisoning, and cross-tenant vector store leaks, then implement concrete fixes to meet 2026 security best practices.

Quick Start

Use the llm-security-tester skill to scan my LLM-powered customer support agent for OWASP LLM Top 10 and MITRE ATLAS vulnerabilities, including prompt injection and MCP tool poisoning risks.

Frequently Asked Questions about llm-security-tester

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my LLM application for OWASP Top 10 and MITRE ATLAS vulnerabilities?▼

To scan LLM applications for OWASP Top 10 and MITRE ATLAS vulnerabilities, provide your application's architecture details to the Skill. It analyzes RAG pipelines and agentic systems to identify prompt injection, sensitive data leakage, and excessive agency flaws.

Does this tool detect indirect prompt injection in RAG pipelines and MCP-enabled tools?▼

Yes, this tool detects indirect prompt injection in RAG pipelines and MCP-enabled tools. It analyzes ingested documents and MCP tool interfaces to identify cross-tenant vector store leaks and poisoning risks aligned with MITRE ATLAS v5.4.0 adversary tactics.

What is the best way to remediate LLM07 System Prompt Leakage in my AI agent?▼

The best way to remediate LLM07 System Prompt Leakage is to implement language-specific remediation patterns. This Skill provides production-ready code examples for Python, C#, Java, and TypeScript to fix system prompt leakage and other OWASP LLM vulnerabilities.

Can I use this to secure agentic AI systems built with LangChain and OpenAI APIs?▼

Yes, you can use this to secure agentic AI systems built with LangChain and OpenAI APIs. It scans any application calling LLM APIs from major providers to detect unbounded consumption, supply chain risks, and excessive agency vulnerabilities.

What are the limitations when testing LLM security for vector and embedding weaknesses?▼

When testing LLM security for vector and embedding weaknesses (LLM08), the Skill provides targeted analysis and concrete code fixes but requires accurate architectural context. It focuses on OWASP and MITRE ATLAS mappings rather than generic network penetration testing.

How do I fix supply chain risks in my LLM-integrated customer support application?▼

To fix supply chain risks in your LLM-integrated application, apply the language-specific remediation patterns provided by the Skill. It cross-references identified vulnerabilities with compliance skills to deliver safe, production-ready code examples for Python, C#, Java, and TypeScript.

Related Skills

Explore More Software Engineering Skills→
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

security-audit-context-building

Map architecture, trust boundaries, and data flows for security audit scoping.

Official
Advanced
pluginagentmarketplacepluginagentmarketplace
3

testing-methodologies

Structure AI security testing across reconnaissance, threat modeling, and reporting.

Community
Advanced
corey-alixcorey-alix

Code Review and Quality Assurance

Review TypeScript code for strict compliance, error handling, input validation, and security.

Official
Intermediate
cmndcntrlcybercmndcntrlcyber
3

hunt-aspnet

Detect ASP.NET security vulnerabilities and reveal configuration metadata.

Community
Advanced