LLM Red-Team

Reflection is not exploitation. A model that echoes your payload is noise; a model that acts on it, leaks its system prompt, emits your canary, calls a tool, renders raw HTML downstream, is a bug. Prove the action, then chain it to concrete impact.

This is the first-class LLM-attack skill. The scanner behind it is bughunter/tools/llm_redteam.py (canary-based corpus runner, /llm-redteam). For auditing an MCP server, use skills/mcp-server-audit; for attacking a deployed agent black-box, use skills/agentic-app-audit.

0. QUICK KILL CHECKLIST

Kill the lead (classify Informational, move on) when:

• The model refuses and no canary / leak / tool-call ever lands. "It said something edgy" is not a finding.
• System-prompt "leak" is just generic assistant boilerplate ("I am a helpful assistant"), not the target's actual instructions.
• Prompt injection fires but reads/changes nothing the current user couldn't already access (no cross-tenant data, no tool with impact).
• Output looks like XSS but the host app escapes it before rendering (check the actual downstream sink, not the chat response).
• Exfil payload is a markdown image beacon but the client never fetches remote images.

1. ROUTING TABLE, signal on target -> what to run

Signal	Run
Any chat/assistant endpoint	bughunter/tools/llm_redteam.py --url <endpoint> --field <json-field> (full corpus)
OpenAI-style API	--template '{"messages":[{"role":"user","content":"{{PAYLOAD}}"}]}' --response-path choices.0.message.content
Only want one class	--category jailbreak (see --list-categories)
Uploads/RAG/"summarize this doc"	indirect-injection + token-smuggling (invisible unicode in the doc)
Agent has tools	excessive-agency category + skills/agentic-app-audit
Confirm blind exfil	plant a canary host, correlate with bughunter/tools/oob_listener.py

2. ATTACK CLASSES (corpus categories)