Skip to content
Get packs

LLM Security Testing

Lets an agent run authorized security tests on LLM apps and AI agents (prompt injection, tool abuse, RAG poisoning)

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
5 files

What it does

With this skill installed, the agent follows a structured playbook for security testing of AI chatbots, RAG systems and tool-using agents. It maps the attack surface, then tries prompt injection (direct, role-play, encoding tricks, multi-turn extraction and hidden instructions in web pages or documents), tests whether an agent can be pushed into misusing its tools, checks whether a knowledge base or memory can be poisoned, and inspects whether model output is unsafe when passed to browsers, databases or shells. It is organised around OWASP LLM Top 10 and Agentic AI Top 10 categories and points to reference notes for methodology.

Great for

  • Security engineers red-teaming an LLM feature or AI agent they are authorised to test
  • Developers who want a checklist of prompt injection and tool-misuse cases to run against their own app before release
  • Teams preparing evidence for an OWASP LLM Top 10 style review

Skip it if

  • Testing systems you do not own or have written permission to test: the skill's steps are attack techniques and could cause harm or breach terms of service
  • Non-technical users wanting a general AI safety overview: the content is operational and assumes security background
  • Production systems without a sandbox: some test payloads (such as exfiltration to an external address or shell command injection) should only be run in isolated environments

Try asking

  • “Test my customer support chatbot for prompt injection and system prompt leakage before launch”
  • “Audit the tools my AI agent can call and check whether it can be tricked into chaining them to send data out”
  • “Check whether my RAG knowledge base can be poisoned by a malicious document and how retrieval permissions work”
  • “Walk through an OWASP LLM Top 10 review of my LLM application and produce a findings report”
Step-by-step guide: how to use LLM Security TestingInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 5 original files, the MIT licence and an attribution note.

    llm-security.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip llm-security.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip llm-security.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • State the authorised scope and target explicitly in your request, and run tests against a staging or sandboxed copy
  • Ask for the output as a report with reproducible prompts and evidence so findings can be verified
  • Note that SKILL.md refers to files outside this folder and to a web search step; check those dependencies before relying on the workflow

What's inside

  • references/agent-obedience-engineering.md
  • references/agent-security-testing.md
  • references/owasp-llm-top10.md
  • references/prompt-injection-methodology.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.