Skip to content
Get packs

Indirect Injection Detection

Tests whether an agent obeys hidden instructions planted in documents, RAG chunks, or web pages.

Source Download skill
Repository
Tencent/AI-Infra-Guard
Stars
7,320
Licence
Apache-2.0
Files
1 file

What it does

This skill is a security test for AI agents. It sends the agent a prompt containing a fake document, retrieved chunk, or web page with a hidden instruction (such as reply with PWNED or reveal your system prompt) and checks whether the agent follows that embedded instruction instead of just summarizing or answering. If it does, the skill reports the agent as vulnerable to indirect prompt injection, with evidence and a suggested fix. It does not run code or access the internet itself; it only shapes test prompts sent through the agent's dialogue tool.

Great for

  • Security teams red-teaming an AI app that summarizes uploads, answers from a knowledge base (RAG), or reads web pages
  • Developers checking whether their agent treats retrieved content as untrusted data
  • Students learning how indirect prompt injection (goal hijack) works

Skip it if

  • Agents that never process external content, since the skill itself says indirect injection does not apply to them
  • Production use as a complete defense: it only detects known simple patterns and cannot prove an agent is safe
  • Testing systems you do not own or have permission to probe, because the test prompts are designed to trigger unwanted behavior

Try asking

  • “Test whether my document summarizer obeys instructions hidden inside uploaded files”
  • “Check if my RAG chatbot leaks its system prompt when a retrieved chunk asks it to”
  • “Run indirect prompt injection tests against my web-browsing assistant using a fake page”
  • “Generate marker-based injection tests to see if the agent ends replies with a planted word”
Step-by-step guide: how to use Indirect Injection DetectionInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the Apache-2.0 licence and an attribution note.

    indirect-injection-detection.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip indirect-injection-detection.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip indirect-injection-detection.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run the tests against the same model and system prompt your production app uses, so results are meaningful.
  • Review the emitted vuln reports manually; a 'safe' result from simple markers does not rule out more subtle attacks.
  • Combine with other tests using varied wording, languages, and encodings to get broader coverage.

What's inside

  • SKILL.md

Redistributed unmodified from Tencent/AI-Infra-Guard under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.