# LLM Redteam

LLM application red-teaming, prompt injection (direct + indirect), jailbreak...

- Repository: https://github.com/awarexone/Agentic-Bug-Hunter (5532 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-28
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add awarexone/Agentic-Bug-Hunter --skill llm-redteam -g -a claude-code -y`
Codex: `npx skills add awarexone/Agentic-Bug-Hunter --skill llm-redteam -g -a codex -y`
Cursor: `npx skills add awarexone/Agentic-Bug-Hunter --skill llm-redteam -g -a cursor -y`
Gemini CLI: `npx skills add awarexone/Agentic-Bug-Hunter --skill llm-redteam -g -a gemini-cli -y`

## Description

LLM application red-teaming, prompt injection (direct + indirect), jailbreak, system-prompt leak, data exfiltration, guardrail bypass, multi-turn crescendo, cross-lingual + cipher + invisible-unicode token smuggling, excessive agency / tool abuse, insecure output handling. Canonical OWASP LLM Top 10 + ASI01-ASI10 mapping. Use when a target exposes a chat/completions/assistant/copilot endpoint, an AI feature that consumes user text or documents, or any /v1/chat, /api/chat, /mcp surface.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# LLM Red-Team

> Reflection is not exploitation. A model that *echoes* your payload is noise; a model that *acts* on it, leaks its system prompt, emits your canary, calls a tool, renders raw HTML downstream, is a bug. Prove the action, then chain it to concrete impact.

This is the first-class LLM-attack skill. The scanner behind it is `bughunter/tools/llm_redteam.py` (canary-based corpus runner, `/llm-redteam`). For auditing an MCP *server*, use `skills/mcp-server-audit`; for attacking a *deployed agent* black-box, use `skills/agentic-app-audit`.

## 0. QUICK KILL CHECKLIST

Kill the lead (classify Informational, move on) when:

- The model refuses and no canary / leak / tool-call ever lands. "It said something edgy" is not a finding.
- System-prompt "leak" is just generic assistant boilerplate ("I am a helpful assistant"), not the target's actual instructions.
- Prompt injection fires but reads/changes nothing the current user couldn't already access (no cross-tenant data, no tool with impact).
- Output looks like XSS but the host app escapes it before rendering (check the actual downstream sink, not the chat response).
- Exfil payload is a markdown image beacon but the client never fetches remote images.

## 1. ROUTING TABLE, signal on target -> what to run

| Signal | Run |
|---|---|
| Any chat/assistant endpoint | `bughunter/tools/llm_redteam.py --url <endpoint> --field <json-field>` (full corpus) |
| OpenAI-style API | `--template '{"messages":[{"role":"user","content":"{{PAYLOAD}}"}]}' --response-path choices.0.message.content` |
| Only want one class | `--category jailbreak` (see `--list-categories`) |
| Uploads/RAG/"summarize this doc" | indirect-injection + token-smuggling (invisible unicode in the doc) |
| Agent has tools | excessive-agency category + `skills/agentic-app-audit` |
| Confirm blind exfil | plant a canary host, correlate with `bughunter/tools/oob_listener.py` |

## 2. ATTACK CLASSES (corpus categories)

The rest: https://github.com/awarexone/Agentic-Bug-Hunter/blob/HEAD/skills/llm-redteam/SKILL.md