skills.rest
alex-ilgayev
alex-ilgayevCOMMUNITY
Explore all skills by this author →
Website𝕏@_alex_il_GitHub

security-integration-tests

Runs and debugs prompt injection detection integration tests against the HuggingFace Inference API.

517|79|Updated Jul 17, 2025
Search Tags:#mcp#prompt injection#Security#huggingface#Go testing#Integration Tests#test samples
One-click install
npx skills add https://github.com/alex-ilgayev/MCPSpy --skill security-integration-tests
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-integration-tests
Source: https://github.com/alex-ilgayev/MCPSpy/tree/main/.claude/skills/security-integration-tests.md
Command: npx skills add https://github.com/alex-ilgayev/MCPSpy --skill security-integration-tests

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Verifying that prompt injection detection actually works requires real API calls to HuggingFace models, and running, debugging, or extending these integration tests involves specific tokens, build tags, and test data formats that are easy to get wrong.

Core Features & Use Cases

  • Test Execution Guidance: Run integration tests with HF_TOKEN, custom models via HF_MODEL, or unit tests with a mock server that needs no network access.
  • Test Sample Management: Add benign, malicious, or MCP tool call samples to samples.json with expected detection results and minimum risk scores.
  • Troubleshooting Support: Diagnose common failures such as Forbidden errors from invalid tokens, model warm-up skips, and sandboxed network restrictions.
  • Use Case: When a new jailbreak pattern emerges, add it as a malicious sample in samples.json, then run the integration tests to confirm the analyzer flags it with the expected risk score.

Quick Start

Run the security integration tests with my HuggingFace token and help me fix any failures.

Frequently Asked Questions about security-integration-tests

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run prompt injection detection integration tests?▼

Run integration tests with HF_TOKEN set, using the command HF_TOKEN=hf_xxx make test-integration. These tests make real calls to the HuggingFace Inference API and are excluded from regular go test runs by the integration build tag.

How do I add new test samples for prompt injection detection?▼

Edit pkg/security/testdata/samples.json and add entries to benign_samples, malicious_samples, or mcp_tool_calls. Set expected_detected and optionally min_risk_score, then run the integration tests to verify detection accuracy.

Can I run security tests without a HuggingFace API token?▼

Yes, unit tests run without API calls by using a mock server via go test -v ./pkg/security/.... Only the integration tests require a valid HF_TOKEN and network access to the HuggingFace API.

Why do integration tests fail with a Forbidden error?▼

A Forbidden error means HF_TOKEN is missing or invalid. Also note that meta-llama/Llama-Prompt-Guard-2-86M is deprecated on the HF Inference API, so use the default test model protectai/deberta-v3-base-prompt-injection-v2 instead.

Why do HuggingFace integration tests skip on the first run?▼

HuggingFace warms up models on demand, so tests may skip with a Model loading message on the first run. Re-run the tests after the model is warm and they should execute normally.

Related Skills

Explore More Software Engineering Skills→
githubgithub
5.1k

developer-internals

Documents gh-aw compiler internals covering validation architecture, safe outputs, schemas, and YAML parsing.

Official
Advanced
v1bh0rv1bh0r

nw-canary

Detect auto-injection activation status in runtime environments.

Community
Basic
imsatoshiimsatoshi
2

list-feeds-skill

Retrieve Xiaohongshu homepage feed lists via a local MCP HTTP API.

Community
Basic
taracodlabstaracodlabs
779

stable-diffusion-image-generation

Generate images from text prompts using Stable Diffusion via HuggingFace Diffusers or Inference API.

Official
Intermediate