Runs a fixed prompt-injection and data-leak suite against an LLM app build – direct injection, instruction override, system-prompt extraction (with a canary you plant), indirect injection through retrieved documents and tool outputs, exfiltration through links and markdown images.
Runs a fixed prompt-injection and data-leak suite against an LLM app build - direct injection, instruction override, system-prompt extraction (with a canary you plant), indirect injection through retrieved documents and tool outputs, exfiltration through links and markdown images, tool misuse (tools outside an allowlist, ids the user does not own), other customers' PII planted as canary records, and tasteful policy probes - generated from templates in the app's own input shape and scored deterministically by unique markers, canary detection (spaced, reversed, base64) and host allowlists, with a judge only where no rule can decide. Use when someone asks "red-team our chatbot", "test our RAG app for prompt injection", "can the assistant leak the system prompt", "could a poisoned document exfiltrate data", "is our agent's tool use safe", or as the seventh step of an LLM release eval. Do NOT use as a substitute for a human red team or a penetration test of the surrounding web app, for jailbreak research or generating harmful content, or for runtime input filtering (use orchestra-nemo-guardrails).This is the skill's description: the text your AI reads to decide when the skill applies.
This is the skill's header. The step-by-step instructions are paid content and aren't shown here.
llm-red-team-suite/SKILL.md
---
name: llm-red-team-suite
description: Runs a fixed prompt-injection and data-leak suite against an LLM app build - direct injection, instruction override, system-prompt extraction (with a canary you plant), indirect injection through retrieved documents and tool outputs, exfiltration through links and markdown images, tool misuse (tools outside an allowlist, ids the user does not own), other customers' PII planted as canary records, and tasteful policy probes - generated from templates in the app's own input shape and scored deterministically by unique markers, canary detection (spaced, reversed, base64) and host allowlists, with a judge only where no rule can decide. Use when someone asks "red-team our chatbot", "test our RAG app for prompt injection", "can the assistant leak the system prompt", "could a poisoned document exfiltrate data", "is our agent's tool use safe", or as the seventh step of an LLM release eval. Do NOT use as a substitute for a human red team or a penetration test of the surrounding web app, for jailbreak research or generating harmful content, or for runtime input filtering (use orchestra-nemo-guardrails).
---
… the full instructions are part of a premium pack and load in your AI once you have access.