New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Detecting Indirect Prompt Injection

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Detect and defend against indirect prompt injection hidden in web pages, documents, and images consumed by an agent, via content extraction (HTML/PDF/OCR), normalization, and scanning with LLM…

Apache-2.0Auto-check: warningsSecurity

Install Detecting Indirect Prompt Injection

The automated check flagged lines worth reading first. See the safety section below.

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-indirect-prompt-injection -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-indirect-prompt-injection --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/detecting-indirect-prompt-injection .claude/skills/detecting-indirect-prompt-injection && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
detecting-indirect-prompt-injection
GitHub stars
34k
Token cost
~2.8k tokens
SKILL.md length
834 words
Files
5 (incl. scripts, references)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Detect and defend against indirect prompt injection hidden in web pages, documents, and images consumed by an agent, via content extraction (HTML/PDF/OCR), normalization, and scanning with LLM…

  • Works in 7 steps: Extract hidden text from web content → Normalize and de-obfuscate → Scan with LLM Guard's PromptInjection… → …
  • An agent ingests untrusted external content and you need to screen it for injected instructions before the LLM processes it
  • SKILL.md covers Overview, When to Use, Prerequisites and Objectives, plus 5 more sections
  • Runs Python scripts from its folder; calls pip and python

What it does

Detecting Indirect Prompt Injection is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Detect and defend against indirect prompt injection hidden in web pages, documents, and images consumed by an agent, via content extraction (HTML/PDF/OCR), normalization, and scanning with LLM Guard's PromptInjection scanner or Hugging Face Prompt Guard 2. Use when an agent ingests untrusted external content and you need to screen it for injected instructions before the LLM processes it.

Its SKILL.md is about 2.8k tokens, which your agent loads only when the skill is triggered. The skill folder holds 6 other files, including scripts and reference files (for example `references/api-reference.md`, `references/standards.md` and `scripts/agent.py`).

It sits in Security, covering Prompt injection and agent security, LLM guardrails and Database schema design. It works with Hugging Face. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • An agent ingests untrusted external content and you need to screen it for injected instructions before the LLM processes it
  • Tasks that involve Prompt injection and agent security
  • Tasks that involve LLM guardrails

Example prompts

  • “/detecting-indirect-prompt-injection”

Requirements

  • Python 3

Workflow steps

7 steps, taken from the step headings in SKILL.md.

  1. Extract hidden text from web content
  2. Normalize and de-obfuscate
  3. Scan with LLM Guard's PromptInjection scanner
  4. Add a dedicated detector model (Prompt Guard 2 / deberta)
  5. Extract and scan text rendered inside images
  6. Enforce a decision and emit telemetry
  7. Validate against a corpus and tune thresholds

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 1 file in scripts/ (Python), which the agent can run.

    Shell commands in SKILL.md call:

    • pip
    • python

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • github.com
    • huggingface.co
    • crummy.com
    • atlas.mitre.org
    • genai.owasp.org

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Detecting Indirect Prompt Injection loads about 2.8k tokens when it runs, and up to ~3.7k if it reads all its reference files. Until then it costs about 107 tokens; SKILL.md has 834 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~107
When it runs · the whole SKILL.md, loaded when a task matches
~2.8k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~3.7k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: warnings

The automated check found patterns that need a careful read before installing.

  • NoteRuns commands with sudoSKILL.md:62
    #   Debian/Ubuntu: sudo apt-get install -y tesseract-ocr
  • WarningContains zero-width charactersSKILL.md:115
    ZERO_WIDTH = dict.fromkeys(map(ord, "⟨U+200B⟩⟨U+200C⟩⟨U+200D⟩⟨U+2060⟩⟨U+FEFF⟩"), None)

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 834 words, ~2,767 tokens.

Download SKILL.mdSave it as .claude/skills/detecting-indirect-prompt-injection/SKILL.md (or your agent's skills folder). This skill also uses 4 other files; get the full folder from GitHub.
name
detecting-indirect-prompt-injection
description
Detect and defend against indirect prompt injection hidden in web pages, documents, and images consumed by an agent, via content extraction (HTML/PDF/OCR), normalization, and scanning with LLM Guard's PromptInjection scanner or Hugging Face Prompt Guard 2. Use when an agent ingests untrusted external content and you need to screen it for injected instructions before the LLM processes it.
domain
cybersecurity
subdomain
ai-security
tags
ai-security, indirect-prompt-injection, llm-defense, agent-security, content-scanning, llm-guard, multimodal, owasp-llm
version
1.0
author
mahipal
license
Apache-2.0
nist_ai_rmf
MEASURE-2.7
atlas_techniques
AML.T0051.001

Detecting Indirect Prompt Injection

Authorized-use-only notice: Scripts in this skill scan untrusted content for injection payloads and run detector models. Run scanning only on data you are authorized to process, and treat any extracted payloads as live untrusted input — never paste them back into a privileged LLM context.

Overview

Indirect prompt injection (MITRE ATLAS AML.T0051.001, OWASP LLM01:2025) occurs when an LLM-powered agent ingests external content — a web page it browses, a PDF or email it summarizes, an image it OCRs, a tool result it reads — and that content contains hidden instructions the model then follows as if they came from the developer or user. Because the agent treats all tokens in its context window as equally authoritative, an attacker who controls any consumed artifact can hijack the agent's behavior: exfiltrate conversation history, redirect tool calls, leak secrets, or pivot through connected systems.

Unlike direct injection (the user types the attack), indirect injection arrives through a trusted-looking data channel, which is why naive input filtering misses it. Payloads hide in many forms: HTML comments and display:none/zero-width text on web pages, white-on-white or tiny-font text in PDFs, alt-text and EXIF metadata in images, text rendered into pixels (invisible to OCR-light filters but read by multimodal models), Unicode tag/zero-width characters, and Base64/ROT13 obfuscation. This skill builds a detection pipeline that normalizes and scans every artifact before it reaches the model, combining heuristic/regex detection, dedicated detector models (Meta Prompt Guard 2, ProtectAI's deberta-v3 prompt-injection classifier via LLM Guard), and multimodal extraction for images, and then defines response actions and detection telemetry.

When to Use

  • When building or hardening an agent that browses the web, reads email, summarizes documents, or processes user-uploaded files/images.
  • When you need a content-sanitization gate in front of an LLM that ingests third-party data.
  • During AI red-team / blue-team exercises validating that injected instructions in retrieved artifacts are caught.
  • When investigating an incident where an agent behaved as if it received instructions you did not author.
  • As a CI/CD pre-ingestion scan for documents added to a knowledge base.

Prerequisites

  • Python 3.10+ and a virtual environment.
  • Install the detection tooling:
bash
python -m venv .venv && source .venv/bin/activate

# LLM Guard — input/output scanners incl. PromptInjection
pip install llm-guard

# Hugging Face transformers for Prompt Guard 2 / deberta classifiers
pip install transformers torch

# Content extraction: HTML, PDF, images
pip install beautifulsoup4 pypdf pillow pytesseract
# pytesseract requires the Tesseract OCR engine:
#   Debian/Ubuntu: sudo apt-get install -y tesseract-ocr
#   macOS:         brew install tesseract
#   Windows:       choco install tesseract
  • Access (gated) to meta-llama/Llama-Prompt-Guard-2-86M on Hugging Face, or use the open protectai/deberta-v3-base-prompt-injection-v2 classifier.

Objectives

  • Extract human-invisible and obfuscated text from web pages, PDFs, and images.
  • Normalize content (strip zero-width chars, decode Base64/ROT13, flatten Unicode) before scanning.
  • Run heuristic and ML-based injection detectors (LLM Guard PromptInjection scanner, Prompt Guard 2).
  • Score each artifact and enforce a block / sanitize / allow decision before model ingestion.
  • Emit structured detection telemetry suitable for a SIEM and map findings to ATLAS AML.T0051.001.

MITRE ATT&CK Mapping

IDOfficial NameRelevance
AML.T0051.001LLM Prompt Injection: IndirectThe exact technique this skill detects and mitigates
AML.T0051LLM Prompt InjectionParent technique covering all prompt-injection variants
AML.T0057LLM Data LeakageCommon objective of an indirect injection that this detection prevents
AML.T0053LLM Plugin CompromiseInjected instructions frequently target the agent's tools/plugins

Workflow

1. Extract hidden text from web content

Pull comments, hidden elements, and metadata that a human never sees but the model does.

python
# extract_html.py
from bs4 import BeautifulSoup, Comment

def extract_hidden(html: str):
    soup = BeautifulSoup(html, "html.parser")
    hidden = []
    for c in soup.find_all(string=lambda t: isinstance(t, Comment)):
        hidden.append(("comment", c.strip()))
    for el in soup.select('[style*="display:none"],[style*="visibility:hidden"],[hidden]'):
        hidden.append(("css-hidden", el.get_text(strip=True)))
    for img in soup.find_all("img"):
        if img.get("alt"):
            hidden.append(("alt-text", img["alt"]))
    return [h for h in hidden if h[1]]
Show full SKILL.md (333 more words)Show less
2. Normalize and de-obfuscate

Strip zero-width / Unicode-tag characters and decode common encodings so detectors see the real payload.

python
# normalize.py
import base64, codecs, re, unicodedata

ZERO_WIDTH = dict.fromkeys(map(ord, ""), None)
TAG_RANGE = range(0xE0000, 0xE0080)  # Unicode tag chars used to smuggle text

def normalize(text: str) -> str:
    text = text.translate(ZERO_WIDTH)
    text = "".join(ch for ch in text if ord(ch) not in TAG_RANGE)
    text = unicodedata.normalize("NFKC", text)
    for token in re.findall(r"[A-Za-z0-9+/=]{20,}", text):
        try:
            decoded = base64.b64decode(token).decode("utf-8", "ignore")
            if decoded.isprintable():
                text += f"\n[decoded-b64] {decoded}"
        except Exception:
            pass
    text += "\n[decoded-rot13] " + codecs.decode(text, "rot_13")
    return text
3. Scan with LLM Guard's PromptInjection scanner

LLM Guard wraps a transformer classifier and returns a risk score per input.

python
# scan_llmguard.py
from llm_guard.input_scanners import PromptInjection
from llm_guard.input_scanners.prompt_injection import MatchType

scanner = PromptInjection(threshold=0.5, match_type=MatchType.FULL)

def scan(text: str):
    sanitized, is_valid, risk = scanner.scan(text)
    return {"is_valid": is_valid, "risk": risk}  # is_valid=False => injection detected
4. Add a dedicated detector model (Prompt Guard 2 / deberta)

Run Meta Prompt Guard 2 (or the open ProtectAI deberta classifier) for a second opinion.

python
# detector_model.py
from transformers import pipeline

# Open classifier (no gating); swap to meta-llama/Llama-Prompt-Guard-2-86M if licensed
clf = pipeline("text-classification",
               model="protectai/deberta-v3-base-prompt-injection-v2")

def is_injection(text: str, threshold: float = 0.5) -> bool:
    out = clf(text[:512])[0]
    return out["label"].upper() == "INJECTION" and out["score"] >= threshold
5. Extract and scan text rendered inside images

Multimodal agents read text painted into pixels; OCR it and run the same scanners.

python
# scan_image.py
from PIL import Image
import pytesseract

def ocr(path: str) -> str:
    return pytesseract.image_to_string(Image.open(path))
# Feed ocr(path) through normalize() + scan() + is_injection()
6. Enforce a decision and emit telemetry

Combine signals into block / sanitize / allow, and log a structured event for the SIEM.

python
# decide.py
import json, hashlib
from datetime import datetime, timezone

def decide(source, raw, normalized, llmguard_invalid, model_flag):
    flagged = llmguard_invalid or model_flag
    event = {
        "ts": datetime.now(timezone.utc).isoformat(),
        "source": source,
        "sha256": hashlib.sha256(raw.encode("utf-8", "ignore")).hexdigest(),
        "atlas": "AML.T0051.001",
        "llmguard_injection": llmguard_invalid,
        "model_injection": model_flag,
        "decision": "block" if flagged else "allow",
    }
    print(json.dumps(event))
    return event["decision"]
7. Validate against a corpus and tune thresholds

Run the pipeline over a labeled set of clean + injected artifacts, measure precision/recall, and tune threshold to balance false positives against missed injections. Re-test whenever the agent's model or ingestion sources change.

Tools and Resources

ToolPurposeSource
LLM GuardInput/output scanners incl. PromptInjectionhttps://github.com/protectai/llm-guard
Meta Prompt Guard 2Dedicated jailbreak/injection classifierhttps://huggingface.co/meta-llama/Llama-Prompt-Guard-2-86M
ProtectAI deberta-v3Open prompt-injection classifierhttps://huggingface.co/protectai/deberta-v3-base-prompt-injection-v2
BeautifulSoup4HTML parsing / hidden-element extractionhttps://www.crummy.com/software/BeautifulSoup/
pytesseract / TesseractOCR text from imageshttps://github.com/madmaze/pytesseract
MITRE ATLASAI threat technique taxonomyhttps://atlas.mitre.org/
OWASP LLM01:2025Prompt Injection referencehttps://genai.owasp.org/llmrisk/llm01-prompt-injection/

Detection Surfaces Reference

SurfaceHiding techniqueExtraction step
Web pageHTML comments, display:none, alt-textBeautifulSoup hidden-element pass
PDFwhite/tiny font, off-page textpypdf text extraction + normalize
Imagerendered pixels, EXIF, alt-textOCR + metadata read
Any textzero-width / Unicode-tag charsnormalize() de-obfuscation
Any textBase64 / ROT13 encodingdecode pass in normalize()

Validation Criteria

  • Hidden-text extraction implemented for HTML, PDF, and images
  • Normalization strips zero-width/Unicode-tag chars and decodes Base64/ROT13
  • LLM Guard PromptInjection scanner integrated and returning risk scores
  • A dedicated detector model (Prompt Guard 2 or deberta) integrated as a second signal
  • OCR path scans text rendered inside images
  • Block/sanitize/allow decision enforced before model ingestion
  • Structured detection telemetry emitted for SIEM with ATLAS mapping
  • Pipeline validated on a labeled corpus with precision/recall measured
  • Thresholds tuned and documented
  • Findings mapped to MITRE ATLAS AML.T0051.001 and OWASP LLM01:2025

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. 5 hidden characters (zero-width or bidirectional) removed. Raw file

Files

SKILL.md and 4 other files (scripts, references) in skills/detecting-indirect-prompt-injection of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • references/api-reference.md
  • references/standards.md
  • scripts/agent.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Detecting Indirect Prompt Injection next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Detecting Indirect Prompt Injection compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Detecting Indirect Prompt Injection this skillmukul975/Anthropic-Cybersecurity-Skills34k—~2.8kAutomated safety check: WarnApache-2.0
Prompt GuardOrchestra-Research/AI-Research-SKILLs13k1 repos~2.4kAutomated safety check: WarnMIT
AI Agent ActivitySCStelz/security-investigator249—~17kAutomated safety check: PassMIT
Security GuidejnMetaCode/shellward140—~644Automated safety check: WarnApache-2.0
Prompt Injection Defensesickn33/agentic-awesome-skills47k2 repos~4.2kAutomated safety check: WarnMIT
AI Securityalirezarezvani/claude-skills28k—~4.5kAutomated safety check: WarnMIT

Similar skills

  • Prompt Guard

    Orchestra-Research/AI-Research-SKILLs

    Meta's 86M prompt injection and jailbreak detector. An agent skill from Orchestra-Research/AI-Research-SKILLs.

    13k GitHub starsUsed in 1 repo~2.4k tokens
    AI & LLM EngineeringAuto-check: warnings

  • AI Agent Activity

    SCStelz/security-investigator

    Report/investigate RUNTIME ACTIVITY of AI agents (Agent 365 / Copilot Studio / M365 Copilot / Work IQ) — agents used, tools/connectors, channels, tokens, prompt/reply content, and Prompt Shield…

    249 GitHub stars~17k tokensUpdated 2 days ago
    SecurityAuto-check passed

  • Security Guide

    jnMetaCode/shellward

    OpenClaw 安全部署指南 / Security deployment guide — help users secure their OpenClaw installation

    140 GitHub stars~644 tokensUpdated 12 days ago
    SecurityAuto-check: warnings

  • Prompt Injection Defense

    sickn33/agentic-awesome-skills

    Defend AI systems against prompt injection and indirect prompt attacks using input controls, tool permissions, output validation, and isolation boundaries.

    47k GitHub starsUsed in 2 repos~4.2k tokens
    SecurityAuto-check: warnings

  • AI Security

    alirezarezvani/claude-skills

    A skill your agent uses when assessing AI/ML systems for prompt injection, jailbreak vulnerabilities, model inversion risk, data poisoning exposure, or agent tool abuse.

    28k GitHub stars~4.5k tokensUpdated 1 mo ago
    SecurityAuto-check: warnings

  • China AI Compliance Audit

    jnMetaCode/shellward

    按中国法规（网安法 / PIPL / 等保2.0 / 数据出境 / AI生成内容标识）审计一个 AI 项目的代码仓库，产出每条都带 文件:行 取证、经独立复核、经脚本校验的合规报告。当用户问「这个项目上线合不合规」「调用了 OpenAI/Claude 算不算数据出境」「要不要做 AI 标识」「帮我做合规自查/等保/PIPL 检查」时使用。Audit an AI project's…

    140 GitHub stars~1.1k tokensUpdated 12 days ago
    SecurityAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Works with

Categories

Questions about Detecting Indirect Prompt Injection

What does Detecting Indirect Prompt Injection do?

Detect and defend against indirect prompt injection hidden in web pages, documents, and images consumed by an agent, via content extraction (HTML/PDF/OCR), normalization, and scanning with LLM…. Detecting Indirect Prompt Injection is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Detect and defend against indirect prompt injection hidden in web pages, documents, and images consumed by an agent, via content extraction (HTML/PDF/OCR), normalization, and scanning with LLM Guard's PromptInjection scanner or Hugging Face Prompt Guard 2.

When should I use Detecting Indirect Prompt Injection?

Detecting Indirect Prompt Injection fits situations like: an agent ingests untrusted external content and you need to screen it for injected instructions before the LLM processes it; tasks that involve Prompt injection and agent security; tasks that involve LLM guardrails.

How do I install Detecting Indirect Prompt Injection in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-indirect-prompt-injection -a claude-code`. Or copy the skill folder (skills/detecting-indirect-prompt-injection in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/detecting-indirect-prompt-injection in your project. Claude Code loads it when a task matches its description.

How do I install Detecting Indirect Prompt Injection in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-indirect-prompt-injection -a codex`. Or copy the skill folder (skills/detecting-indirect-prompt-injection in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/detecting-indirect-prompt-injection in your project. Codex loads it when a task matches its description.

Can I use Detecting Indirect Prompt Injection in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-indirect-prompt-injection -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/detecting-indirect-prompt-injection, .gemini/skills/detecting-indirect-prompt-injection, .github/skills/detecting-indirect-prompt-injection and .opencode/skills/detecting-indirect-prompt-injection in your project.

What does Detecting Indirect Prompt Injection need to run?

Going by SKILL.md and its folder, Detecting Indirect Prompt Injection needs Python for the scripts in its folder and the command-line tools its instructions call (pip and python). Our summary lists: Python 3.

Does Detecting Indirect Prompt Injection access the network?

SKILL.md names 5 domains. As links in the text: github.com, huggingface.co, crummy.com, atlas.mitre.org and genai.owasp.org. This is read from the text; nothing was executed.

Is Detecting Indirect Prompt Injection safe to install?

Our automated static check of SKILL.md flagged 1 warning(s): contains zero-width characters. Read the flagged lines before installing; the check is not a guarantee either way. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Detecting Indirect Prompt Injection use?

Detecting Indirect Prompt Injection is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Detecting Indirect Prompt Injection use?

About 2.8k tokens (SKILL.md is roughly 11k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 906 tokens, read only when the agent opens those files.

What are the alternatives to Detecting Indirect Prompt Injection?

Skills that share tags, products or a category with Detecting Indirect Prompt Injection: Prompt Guard (Orchestra-Research/AI-Research-SKILLs, 13k stars), AI Agent Activity (SCStelz/security-investigator, 249 stars), Security Guide (jnMetaCode/shellward, 140 stars) and Prompt Injection Defense (sickn33/agentic-awesome-skills, 47k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Detecting Indirect Prompt Injection?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 34,116 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.