prompt-injection_skill

Overview

This skill tests and validates LLM defenses against prompt injection, jailbreaks, and input-manipulation attacks. It provides a structured red-teaming workflow, proven payload classes, and severity-driven reporting aligned with OWASP LLM01. Use it to quantify bypass rates and produce actionable mitigation recommendations. The focus is practical: reproduce, classify, and remediate prompt injection weaknesses.

How this skill works

The skill runs a phased protocol: establish a baseline, execute simple and advanced injection vectors, attempt system-prompt extraction, and document results. It enumerates attack categories (authority, hypothetical, encoding, fragmentation, context confusion, role-based) and provides payload templates and a payload-crafting framework. Outputs include test evidence, bypass success rates, severity ratings, and prioritized mitigation guidance for defenders.

When to use it

• During security assessments of LLM integrations and chat agents
• Before deploying models into production-facing or safety-sensitive contexts
• When validating filtering, input preprocessing, or content-moderation controls
• When measuring resilience after model updates or policy changes
• As part of an incident response to suspected prompt-leak or jailbreak events

Best practices

• Start with a clear baseline of normal behavior and refusal patterns to reduce false positives
• Run payloads multiple times and compute statistical success rates for non-deterministic models
• Use phased escalation: from simple prompts to encoding, multi-turn fragmentation, and system extraction
• Record exact payloads, timestamps, and response excerpts for reproducibility and root-cause analysis
• Classify findings by severity (Critical/High/Medium/Low) and map each to concrete mitigation steps

Example use cases

• Automated unit tests that assert authority and encoding jailbreaks are blocked in CI pipelines
• Red-team engagements to measure how often multi-turn fragmentation leads to a successful bypass
• Validation of content filters by testing Base64, ROT13, leetspeak, and homoglyph encodings
• Pre-release security checks to ensure system prompt and internal instructions cannot be extracted
• Post-mortem analysis after a model produced policy-violating content to identify attack vectors