Prompt Injection Audit

Contents

• Scope & authorization (blast-radius labels)
• Model endpoint or agent application: when to use a scanner instead
• Phase 0 - target profile: what is even reachable
• Phase 1 - oracle and channel setup, with the canary gate
• Phase 2 - technique-family triage
• Phase 3 - matrix run
• Phase 4 - judged objectives
• False-positive gates
• Output
• Reference files: references/technique-matrix.md, references/delivery-channels.md, references/results-schema.md

Scope & authorization

Only run against an LLM application you own or are contractually engaged to test. This skill makes a target agent take actions its operator did not intend, so the authorization has to name the agent, its tools, and the accounts it acts as - not just the web app in front of it.

Blast-radius labels:

• Passive (phase 0) - profiling. Reads the app's own surface and documentation.
• Active-3rdparty (phase 1) - stands up a callback host and arms a channel. Payload content reaches your own infrastructure.
• Active (phases 2-4) - the target agent executes injected instructions. Anything it can do, a landed payload can do.

Two objectives need their own sign-off before you run them. Memory poisoning persists past the engagement window and needs an agreed cleanup step. Token exhaustion is resource exhaustion against a metered service: get it in writing, cap it, run it off-peak, or skip it and record it as skipped.

Model endpoint or agent application

Decide this before anything else, because it decides whether this skill is the right instrument.

A raw model endpoint - you hold an API key and send prompts directly - is scanner work. Corpus scanners such as Praetorian's Augustus carry hundreds of probes across dozens of provider bindings and score them with maintained detectors. Point one at the endpoint and take the result. Do not hand-roll a corpus here; a payload library frozen in markdown goes stale against the next model revision, and breadth is not what a methodology skill adds.

An agent application - a model wired to tools, channels, memory and an approval gate - is what this skill is for. A generator-level scanner cannot reach it: it has no way to poison a wiki page the agent browses, no way to follow a landed instruction into the agent's credentials and tool calls, no way to confirm an instruction survived into a later session, and no view of the approval gate. Those are the findings that matter in an engagement, and they only exist above the endpoint.

Both, when you have both. Run the scanner first for baseline model susceptibility, then this skill for what the surrounding application does with an injection that lands. The scanner tells you the model complies; only the channel matrix tells you what that is worth.

Phase 0 - target profile

Nothing is composable until you know what the agent can reach. Establish, without sending a payload:

• Model and version backing the agent. Record it. Results expire when it changes, and a re-run after a model update is the most valuable thing this skill produces.
• Tools the agent holds: fetch/browse, file read, code execution, message or email send, memory write. This decides which objectives exist at all - no fetch tool means no SSRF objective and no page delivery; no memory write means no memory poisoning.
• Untrusted channels that reach context: web pages, tool and API responses, uploaded files, tickets and issues, the RAG corpus. See references/delivery-channels.md.
• Approval gates: does a human confirm tool calls, and does the confirmation show full arguments or a summary? A gate that shows a truncated argument is a finding on its own.

Output of this phase is the applicable set: objectives x reachable channels. Everything outside it is not-applicable and must say so in the ledger rather than appearing as a clean result.

Phase 1 - oracle and channel setup

Stand up the callback listener first; it is the instrument. Reuse the ssrf-oob skill rather than rebuilding it, and encode family, objective and run index into the subdomain label so every hit attributes itself without correlation.

Arm one channel from references/delivery-channels.md.

Then the canary gate, which is not optional. Before any payload, place a benign marker in the channel: a unique string carrying no instruction, which the agent should simply quote back if it read the content. Do not proceed until the canary round-trips.

This is what makes a negative result mean anything. Without it, "no injection landed" and "the agent never fetched the document" are indistinguishable, and a whole matrix of nulls looks like a hardened target when it is actually an unread channel.

Phase 2 - technique-family triage

Run one payload per family, not per instance. The eleven public jailbreaks in circulation collapse into five families (references/technique-matrix.md); testing all eleven up front spends runs on near-duplicates.

Carry the cheapest deterministic objective the target supports - usually markdown-image exfil, which needs only that the client renders markdown. Five runs total. Families that produce nothing here are dropped from phase 3.

Triage tells you which way the instruction hierarchy is soft, which is more useful than any single payload result.

If the target's raw model endpoint is also reachable, take baseline susceptibility from a corpus scanner instead of hand-rolling this phase, and spend the saved runs on phase 3.