AI LLM Agent Security
zhaji2333/CkSKILLS
当目标为 LLM 应用/Chatbot/智能客服/AI 助手/Copilot/Agent/RAG 知识库/多模态模型，或发现用户输入进入大模型提示、工具调用、知识库检索、对话记忆、文件解析，或需要测试提示词注入/越狱逃逸/System Prompt 泄露/训练数据与敏感信息泄露/RAG 检索污染/Agent 记忆污染/工具滥用与命令执行/SSRF/沙箱逃逸时调用。负责 OWASP LLM…
AI/LLM 间接 Prompt 注入攻击。当目标 AI 系统会处理外部数据源（网页、文档、邮件、数据库、API 返回）时使用。覆盖间接注入、工具链劫持、RAG 投毒、数据外泄等技术。OWASP LLM Top 10 1 漏洞类别
Install Prompt Injection
$ npx skills add wgpsec/AboutSecurity --skill prompt-injection -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install wgpsec/AboutSecurity prompt-injection --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/wgpsec/AboutSecurity.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/ai-security/prompt-injection .claude/skills/prompt-injection && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "prompt-injection" agent skill from https://github.com/wgpsec/AboutSecurity/tree/master/skills/ai-security/prompt-injection into .claude/skills/prompt-injection/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "prompt-injection", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/wgpsec/AboutSecurity/tree/master/skills/ai-security/prompt-injectionType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add wgpsec/AboutSecurity --skill prompt-injection -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install wgpsec/AboutSecurity prompt-injection --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/wgpsec/AboutSecurity.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/ai-security/prompt-injection .agents/skills/prompt-injection && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "prompt-injection" agent skill from https://github.com/wgpsec/AboutSecurity/tree/master/skills/ai-security/prompt-injection into .agents/skills/prompt-injection/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "prompt-injection", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add wgpsec/AboutSecurity --skill prompt-injection -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install wgpsec/AboutSecurity prompt-injection --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/wgpsec/AboutSecurity.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/ai-security/prompt-injection .cursor/skills/prompt-injection && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "prompt-injection" agent skill from https://github.com/wgpsec/AboutSecurity/tree/master/skills/ai-security/prompt-injection into .cursor/skills/prompt-injection/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "prompt-injection", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/wgpsec/AboutSecurity.git --path skills/ai-security/prompt-injection--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add wgpsec/AboutSecurity --skill prompt-injection -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install wgpsec/AboutSecurity prompt-injection --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/wgpsec/AboutSecurity.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/ai-security/prompt-injection .gemini/skills/prompt-injection && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "prompt-injection" agent skill from https://github.com/wgpsec/AboutSecurity/tree/master/skills/ai-security/prompt-injection into .gemini/skills/prompt-injection/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "prompt-injection", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install wgpsec/AboutSecurity prompt-injectionInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add wgpsec/AboutSecurity --skill prompt-injection -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/wgpsec/AboutSecurity.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/ai-security/prompt-injection .github/skills/prompt-injection && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "prompt-injection" agent skill from https://github.com/wgpsec/AboutSecurity/tree/master/skills/ai-security/prompt-injection into .github/skills/prompt-injection/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "prompt-injection", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add wgpsec/AboutSecurity --skill prompt-injection -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install wgpsec/AboutSecurity prompt-injection --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/wgpsec/AboutSecurity.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/ai-security/prompt-injection .opencode/skills/prompt-injection && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "prompt-injection" agent skill from https://github.com/wgpsec/AboutSecurity/tree/master/skills/ai-security/prompt-injection into .opencode/skills/prompt-injection/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "prompt-injection", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
prompt-injection- GitHub stars
- 1.8k
- Token cost
- ~704 tokens
- SKILL.md length
- 198 words
- Files
- 2 (incl. references)
- Skills in repo
- 64
- Repo updated
- First seen
- Licence
- None found
At a glance
AI/LLM 间接 Prompt 注入攻击。当目标 AI 系统会处理外部数据源（网页、文档、邮件、数据库、API 返回）时使用。覆盖间接注入、工具链劫持、RAG 投毒、数据外泄等技术。OWASP LLM Top 10 1 漏洞类别
- Works in 5 steps: 间接注入 — 网页/文档载体 → 工具链劫持 (Tool Use Abuse) → RAG 投毒 → …
- Tasks that involve Prompt injection and agent security
- SKILL.md covers 概述, 深入参考, 攻击面分类 and 方法论概览, plus 2 more sections
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Prompt Injection is an agent skill from wgpsec/AboutSecurity. AI/LLM 间接 Prompt 注入攻击。当目标 AI 系统会处理外部数据源（网页、文档、邮件、数据库、API 返回）时使用。覆盖间接注入、工具链劫持、RAG 投毒、数据外泄等技术。OWASP LLM Top 10 1 漏洞类别
Its SKILL.md is about 700 tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/injection-payloads.md`).
It sits in Security, covering Prompt injection and agent security, Web application vulnerabilities and Retrieval-augmented generation. The repository describes itself as: Everything for pentest. | 渗透测试知识库，以 AI Agent 可执行的格式沉淀安全方法论。
When your agent uses it
- Tasks that involve Prompt injection and agent security
- Tasks that involve Web application vulnerabilities
- Tasks that involve Retrieval-augmented generation
Example prompts
- “/prompt-injection”
Workflow steps
5 steps, taken from the step headings in SKILL.md.
- 间接注入 — 网页/文档载体
- 工具链劫持 (Tool Use Abuse)
- RAG 投毒
- 数据外泄
- 高级注入技术
What it can do on your machine
Read from SKILL.md and the folder at commit 914ffb5. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
embracethered.comowasp.orgarxiv.orgkai-greshake.deblog.langchain.dev
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Prompt Injection loads about 704 tokens when it runs, and up to ~2.3k if it reads all its reference files. Until then it costs about 33 tokens; SKILL.md has 198 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check: notes
The automated check noted patterns worth knowing about, such as sudo or a known installer.
- NoteMentions a .env fileSKILL.md:49
Agent 攻击**: 代码仓库 README 中注入 → AI 代码助手读取 .env
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
Without a licence we can't republish the file, so here is its outline and opening line. It has 198 words (~704 tokens).
“Prompt Injection（提示注入）是指攻击者通过 AI 系统处理的外部数据源，注入恶意指令来操控模型行为。与 jailbreak（用户直接输入）不同，injection 利用不受信任的第三方数据作为攻击载体，模型无法区分"数据"和"指令"。”
- name
- prompt-injection
- metadata.tags
- ai,llm,prompt-injection,间接注入,RAG,投毒,工具调用,数据外泄,AI安全,Agent,插件
- metadata.category
- ai-security
Files
SKILL.md and 1 other file (references) in skills/ai-security/prompt-injection of wgpsec/AboutSecurity.
- SKILL.md
- references/injection-payloads.md
Open the folder on GitHubat commit 914ffb5
Compare with similar skills
Prompt Injection next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Prompt Injection this skillwgpsec/AboutSecurity | 1.8k | — | ~704 | Automated safety check: Notes | None | |
| AI LLM Agent Securityzhaji2333/CkSKILLS | 115 | — | ~4.7k | Automated safety check: Warn | MIT | |
| Securing AI Systemstrilwu/secskills | 157 | — | ~2.9k | Automated safety check: Pass | MIT | |
| Sailpillar-labs/sail-skill | 113 | — | ~5.1k | Automated safety check: Pass | Custom licence | |
| Agent Tool Abuse DetectionTencent/AI-Infra-Guard | 6.8k | — | ~1.5k | Automated safety check: Notes | Apache-2.0 | |
| Secureclawadversa-ai/secureclaw | 347 | 1 repos | ~193 | Automated safety check: Pass | MIT |
Similar skills
Securing AI Systems
trilwu/secskills
Assess and harden LLM applications and agentic systems against prompt injection, tool misuse, excessive agency, memory poisoning, RAG data leakage, and model supply-chain risk, mapped to the OWASP…
Sail
pillar-labs/sail-skill
Apply the SAIL (Secure AI Lifecycle) V2 framework by Pillar Security to secure AI applications and agents.
Agent Tool Abuse Detection
Tencent/AI-Infra-Guard
Probes an AI agent through dialogue to check whether its file, code-execution or network tools can be misused to run unexpected code or reach outside targets.
Secureclaw
adversa-ai/secureclaw
Security hardening toolkit for OpenClaw. An agent skill from adversa-ai/secureclaw.
Cso
no-session/pstack
Chief Security Officer mode. An agent skill from no-session/pstack.
More from wgpsec/AboutSecurity
All 64 skills in this repoAboutsecurity Content Ingestion
wgpsec/AboutSecurity
A skill your agent uses whenever the user asks to add, absorb, migrate, port, update, merge, compare, or extract security knowledge into the AboutSecurity repository from any external resource such…
Ad Persistence
wgpsec/AboutSecurity
AD 域环境持久化技术。当已获取域管/本地管理员权限、需要建立持久访问以确保重启或密码更改后仍能回到目标环境时使用。覆盖主机级持久化（计划任务/注册表Run/COM劫持/WMI事件订阅/Windows服务/启动文件夹）、域级持久化（Golden Ticket/Silver Ticket/Skeleton…
Apt Emulation
wgpsec/AboutSecurity
APT 模拟与情报驱动红队方法论。基于已知 APT 组织的 TTP（MITRE ATT&CK）设计红队行动计划。当需要模拟特定威胁组织、设计高仿真攻击演练、或根据威胁情报制定攻击策略时使用
Argocd Tactics
wgpsec/AboutSecurity
ArgoCD 后渗透方法论：Redis缓存投毒集群接管、SSO认证绕过、未授权API枚举、恶意Application部署、Webhook SSRF、默认凭据利用。
C2 Beacon Analysis
wgpsec/AboutSecurity
C2 Beacon 配置提取与分析。当捕获到 Cobalt Strike/Sliver/Havoc 等 C2 框架的 Beacon 样本、内存 dump、或网络流量时使用。提取 C2 地址、通信协议、Malleable Profile、Watermark 等关键情报。红队视角：了解蓝队如何从 Beacon 提取 IOC 以改进 C2 OPSEC
C2 Evasion Methodology
wgpsec/AboutSecurity
C2框架免杀方法论：分析 C2 源码、搜索检测规则(YARA/Sigma/Snort)、逐规则分析、修改源码绕过检测。当遇到 YARA/Sigma/Snort 规则触发告警、beacon/implant 被杀软检测到时使用。第一步：确认 implant/beacon 语言和架构；第二步：搜索对应检测规则并逐规则分析修改
Related
Categories
Questions about Prompt Injection
What does Prompt Injection do?
AI/LLM 间接 Prompt 注入攻击。当目标 AI 系统会处理外部数据源（网页、文档、邮件、数据库、API 返回）时使用。覆盖间接注入、工具链劫持、RAG 投毒、数据外泄等技术。OWASP LLM Top 10 1 漏洞类别. Prompt Injection is an agent skill from wgpsec/AboutSecurity.
When should I use Prompt Injection?
Prompt Injection fits situations like: tasks that involve Prompt injection and agent security; tasks that involve Web application vulnerabilities; tasks that involve Retrieval-augmented generation.
How do I install Prompt Injection in Claude Code?
Run `npx skills add wgpsec/AboutSecurity --skill prompt-injection -a claude-code`. Or copy the skill folder (skills/ai-security/prompt-injection in wgpsec/AboutSecurity) into .claude/skills/prompt-injection in your project. Claude Code loads it when a task matches its description.
How do I install Prompt Injection in Codex?
Run `npx skills add wgpsec/AboutSecurity --skill prompt-injection -a codex`. Or copy the skill folder (skills/ai-security/prompt-injection in wgpsec/AboutSecurity) into .agents/skills/prompt-injection in your project. Codex loads it when a task matches its description.
Can I use Prompt Injection in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add wgpsec/AboutSecurity --skill prompt-injection -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/prompt-injection, .gemini/skills/prompt-injection, .github/skills/prompt-injection and .opencode/skills/prompt-injection in your project.
What does Prompt Injection need to run?
SKILL.md names no scripts, command-line tools or credentials: Prompt Injection is instructions for the agent only.
Does Prompt Injection access the network?
SKILL.md names 5 domains. As links in the text: embracethered.com, owasp.org, arxiv.org, kai-greshake.de and blog.langchain.dev. This is read from the text; nothing was executed.
Is Prompt Injection safe to install?
Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.
What licence does Prompt Injection use?
No licence was found for Prompt Injection or its repository. Without one, default copyright applies: ask the author before reusing or redistributing it.
How many tokens does Prompt Injection use?
About 704 tokens (SKILL.md is roughly 2.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 1.6k tokens, read only when the agent opens those files.
What are the alternatives to Prompt Injection?
Skills that share tags, products or a category with Prompt Injection: AI LLM Agent Security (zhaji2333/CkSKILLS, 115 stars), Securing AI Systems (trilwu/secskills, 157 stars), Sail (pillar-labs/sail-skill, 113 stars) and Agent Tool Abuse Detection (Tencent/AI-Infra-Guard, 6.8k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Prompt Injection?
wgpsec (a GitHub organization) maintains it in wgpsec/AboutSecurity, which has 1,778 GitHub stars. The repository holds 64 skills in this directory. The repository was last updated on October 10, 2026.
Source: wgpsec/AboutSecurity on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.