Guide · Agent skill
How to use the AI Pentest Checklist agent skill (offensive-ai-security)
Updated · written with AI from the project's own documentation and checked against our catalogue data
The offensive-ai-security skill gives an AI agent a structured offensive-security checklist for AI and LLM systems. It covers prompt injection, jailbreaking, model extraction, training data poisoning, RAG poisoning, insecure output handling and supply chain risks. This guide explains what the skill does, how to install it, how to trigger it, and what to keep in mind before using it on a real target.
AI Pentest ChecklistSnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Download the ZIP. Download the offensive-ai-security ZIP from this page.
- 2Unzip the folder. Unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder.
- 3Or upload in the Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the ZIP.
- 4Confirm written authorisation. Make sure you have written permission to test the specific AI system before any probing.
- 5Describe the target. Tell the agent the system type, its components, data sources and tools.
- 6Ask for the checklist. Use a natural request that includes a trigger phrase such as prompt injection or RAG poisoning.
- 7Track and verify. Ask the agent to track progress and verify every finding yourself before reporting it.
What the skill makes the agent do
An agent skill is a folder containing instructions that an AI agent loads when a request matches the skill's topic. This one is built around a file called SKILL.md, which holds a methodology for assessing AI and LLM systems.
When the skill is active, the agent is told to load the full methodology as its checklist, follow the steps in order unless you say otherwise, consider which techniques apply to your target, track which items are complete, and suggest next steps based on findings.
- Covers prompt injection, jailbreaking, model extraction, training data poisoning, adversarial inputs, RAG poisoning and AI system reconnaissance.
- Lists tools such as garak and LLMFuzzer by name, but the files do not include or run them.
- Is a methodology document, not an automated scanner. It does not verify any system by itself.
Install the offensive-ai-security skill
Download the ZIP for this skill from the page. Then choose one of the following options.
For a personal install, unzip the folder into ~/.claude/skills/. For a single project, unzip it into the project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
- Personal: ~/.claude/skills/offensive-ai-security/
- Project: .claude/skills/offensive-ai-security/ inside your project
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
~/.claude/skills/offensive-ai-security/SKILL.mdTrigger the skill with natural requests
You do not need a special command. The skill is meant to activate when your conversation involves its trigger phrases: AI security, LLM security, prompt injection, jailbreak, model extraction, training data poisoning, adversarial input, AI red team, ML security, RAG poisoning and AI attack.
Say what you are working on and what you want the agent to do. Mention that the work is authorised, and name the system type, such as a chatbot, a RAG system or an agent with tools.
- "Using the offensive-ai-security checklist, walk me through prompt injection tests for our customer support chatbot. We have written permission to test it."
- "I run a RAG app over internal PDFs. Which RAG poisoning checks apply, and in what order?"
- "Review our LLM agent's tool permissions against the excessive agency items in the checklist."
Prepare before you test
The methodology assumes active probing of the target. Before you start, you need access to the AI system and written authorisation to test it. The skill starts by asking the agent to understand the system's components, data flow and business impact, so have that information ready.
No software is bundled with the skill. Tools such as garak and LLMFuzzer are named in the checklist, and you would need to install them separately if you choose to use them.
- Written authorisation covering the specific system and scope.
- Access to the target AI system, such as its API or web interface.
- A description of components: the LLM, APIs, data sources and plugins.
- Separate installation of any external tool you decide to use.
Safety notes: scripts and network
The skill does not run scripts and does not use the network by itself. Its instructions are text that the agent follows. Any network activity would come from you or from tools you install and run yourself.
The checklist is written for active exploitation. Do not point it at systems you do not own or have written permission to test, because the techniques could cause real harm or break laws.
- Runs scripts: no
- Uses network: no
- Only test systems you own or are authorised to test in writing.
Tips for getting useful output
Give the agent specific context. A chatbot, a RAG pipeline and a multi-agent system need different checks. The skill asks the agent to consider applicability to each target, so a precise description produces a more relevant plan.
Treat the output as a starting point. The checklist is high-level, and some sections, such as regulatory references, are summaries rather than audit criteria. Verify findings yourself and do not use the output alone for production sign-off.
- Ask the agent to track which checklist items are complete as you go.
- Ask for next steps after each result, since the skill is designed to suggest them.
- Use the mechanisms section to explain attack classes to a non-specialist team.
What people use it for
- Preparing an authorised red-team plan for an LLM chatbot before a penetration test.
- Reviewing a RAG system's document sources, chunking and retrieval policies against the RAG poisoning items.
- Checking an LLM agent's tool permissions and credential scoping against the excessive agency guidance.
- Learning the vocabulary and mechanisms behind prompt injection, model extraction and training data poisoning.
Frequently asked questions
Is the offensive-ai-security skill free to use?
The skill is published under the MIT licence, as stated on this page. Check the licence file in the source repository for the full terms before you reuse or redistribute it.
What do I need to install before using it?
The skill bundles no software. You need an agent that supports skills, the SKILL.md file unzipped into the correct folder, and separately installed tools such as garak or LLMFuzzer only if you choose to use them.
Does the skill scan my AI system automatically?
No. It is a methodology document rather than an automated scanner. It guides the agent through a checklist, but the files do not run any tests or tools.
Can I use it to test someone else's chatbot?
Only with written permission. The checklist is written for active exploitation, so testing systems you do not own or are not authorised to test could cause harm or break laws.
How does this compare with using garak or LLMFuzzer directly?
The skill provides a checklist and planning support, while garak and LLMFuzzer are the tools that carry out the probing. The skill names these tools but does not include or run them, so you would use them alongside it.
Why isn't the skill triggering in my chat?
Make sure the folder is in ~/.claude/skills/ or the project's .claude/skills/ folder, or that the ZIP was uploaded under Settings → Capabilities → Skills. Then include a trigger phrase such as prompt injection or LLM security in your request.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a security engineer preparing an authorised test of an LLM application, a developer reviewing your own chatbot or RAG system, or a student learning LLM attack concepts. Pick something else if you need a finished security report or a sign-off decision for production, because the skill is a high-level methodology that does not verify any system on its own.
Download the skill