skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

testing-llm-prompt-injection-and-jailbreaks

Tests LLM applications for prompt injection, jailbreaks, and system-prompt leakage during authorized penetration tests.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#jailbreak#prompt injection#llm security#AI red teaming#system prompt leak#garak
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill testing-llm-prompt-injection-and-jailbreaks
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: testing-llm-prompt-injection-and-jailbreaks
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/ai-security/testing-llm-prompt-injection-and-jailbreaks
Command: npx skills add https://github.com/xalgord/xalgorix --skill testing-llm-prompt-injection-and-jailbreaks

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

LLM-backed chatbots, copilots, and agents can be manipulated through direct and indirect prompt injection, jailbreak personas, and encoding tricks, yet most testers only try the literal "ignore previous instructions" payload and miss the highest-impact vectors. This Skill provides a structured methodology to systematically test every input and ingested data source, with reliable confirmation signals that distinguish real vulnerabilities from refusals.

Core Features & Use Cases

  • Full Payload Family Coverage: Tests direct injection, indirect injection via ingested data (repo issues, emails, web pages, PDFs), DAN/persona jailbreaks, system-prompt leaking, encoding/obfuscation bypasses, task-wrapper tricks, and tool/agent abuse.
  • Confirmation-Driven Methodology: Uses clean baselines, canary tokens, OOB exfiltration sinks, and repeated runs to confirm non-deterministic LLM behavior before reporting a finding.
  • Automation Integration: Incorporates garak, PyRIT, and promptmap for broad automated red-teaming coverage against chat endpoints.
  • Use Case: During an authorized assessment of a coding agent with GitHub access, plant an obfuscated instruction in a public issue, ask the agent to triage issues, and confirm via an OOB sink whether it executed the planted action — producing an OWASP LLM01-classified finding with reproduction steps and remediation guidance.

Quick Start

Ask the AI to test the target chatbot for prompt injection and jailbreak vulnerabilities following the baseline-then-payload-family workflow, confirming any hits with canary tokens or an OOB sink.

Frequently Asked Questions about testing-llm-prompt-injection-and-jailbreaks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test an LLM application for prompt injection?▼

Start by recording a clean baseline of how the model refuses disallowed requests, then send payload families covering authority overrides, DAN personas, encoding bypasses, and task wrappers. Confirm a hit only when behavior deviates from baseline, and re-run 3-5 times since LLM outputs are non-deterministic.

What is indirect prompt injection and how do I test it?▼

Indirect prompt injection hides malicious instructions in data the agent ingests, such as repo issues, emails, web pages, or PDFs, rather than in the chat box. Plant an attributable instruction in that data, ask the agent its normal task, and confirm via an OOB sink or observed side effect whether it followed the planted instruction.

What tools are used for automated LLM red-teaming?▼

garak provides broad vulnerability probes for jailbreaks, leakage, and encoding attacks, PyRIT orchestrates multi-turn red-teaming with automated scorers, and promptmap runs prompt-injection rules against application chat endpoints. Burp Suite is used to intercept and replay chat API requests.

How do I confirm a system-prompt leak in a chatbot?▼

Ask the model to summarize all instructions given at the start of the chat, repeat text starting with 'You are', or output its first message as JSON. Confirm a genuine leak by matching seeded canary tokens or known policy phrasing rather than generic safety language.

Why do prompt injection tests give inconsistent results?▼

LLM outputs are non-deterministic, so a payload that succeeds once may fail on retry. Treat a single success as a candidate finding and re-run it 3-5 times, comparing against a recorded clean baseline before reporting.

When is authorization required for LLM penetration testing?▼

Written authorization covering the AI application and all connected tools and data is required before any testing. This is especially critical for indirect injection tests that plant payloads in shared systems like repositories or email, and for tool-abuse tests that trigger state-changing actions.

Related Skills

Explore More Software Engineering Skills→
EntroVyxEntroVyx
3

hardcoded-credential-hunt

Scan HTML, JavaScript, and API responses for hardcoded credentials.

Community
Intermediate
wgpsecwgpsec
1.6k

report-generate

Generate structured penetration testing reports with CVSS risk ratings and remediation guidance.

Official
Intermediate
mindfortaimindfortai
16

api-testing

Generate secure API abuse testing plans for applications.

Official
Advanced
brucesongsbrucesongs
60

llm-red-team

Expose LLM system vulnerabilities via a six-phase red-team workflow.

Community
Advanced