How to use the AI/LLM App Attack Testing skill (ai-llm-app-attack)

What the skill makes the agent do

Agent skills are folders containing a SKILL.md file of instructions that an AI agent can load when a task matches. This skill's SKILL.md covers attack categories against LLM applications, and tells the agent how to approach them.

The categories listed include direct prompt injection, where the user tries to override instructions, and indirect prompt injection, which the source describes as the more dangerous form because instructions can be hidden in RAG documents, web pages, emails, tool return values or image EXIF data. It also covers abuse of agent tools, system prompt leakage, RAG poisoning, excessive authorisation and cross-tenant access, MCP plugin supply-chain risks, resource cost attacks, insecure handling of LLM output, and unsafe loading of PyTorch model files via pickle.

• Agent tool abuse: code interpreter injection, fetch tools reaching internal networks or cloud metadata (SSRF), file tools reading files such as /etc/passwd, SQL tools dumping tables, and shell tools with command injection.
• Model files: torch.load defaults to pickle, which the source flags as an RCE risk.
• Endpoint discovery: capture traffic to find paths such as /chat, /agent or /tool, and ask the agent what tools it has.

Install the skill from the ZIP or the Claude apps

Download the ZIP for this skill from the directory page and unzip it. For a personal install, place the unzipped folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder.

If you use the Claude apps instead, upload the skill under Settings → Capabilities → Skills.

• Personal install: ~/.claude/skills/ai-llm-app-attack/
• Project install: .claude/skills/ai-llm-app-attack/ inside your project
• The package contains a single file, SKILL.md.

Trigger the skill with natural requests

You do not need a special command. The skill's description says to use it when testing LLM apps, agents, RAG, MCP plugins, or AI model file risks, so ask in those terms and name the scope you are authorised to test.

Include the target, what you own or have permission to test, and the area you want covered. Vague requests are less useful than specific ones.

• "I have written permission to test our support chatbot at this staging URL. Check it for indirect prompt injection through uploaded documents."
• "Review this MCP plugin before we deploy it. Look for supply-chain risks and tool abuse paths."
• "Our RAG pipeline ingests partner PDFs. Assess whether a poisoned document could change answers."
• "Check whether this project loads model files with torch.load and where pickle could lead to code execution."

Understand what you need before you start

The source lists no required dependencies, does not say the skill runs scripts, and does not say it uses the network. Its only file is SKILL.md. Whether the agent you use can reach your target is determined by your agent and environment, not by this skill's listed requirements.

Because the skill describes live exploitation techniques, treat any run against a real system as a controlled test. Confirm scope and authorisation first.

• Requires: nothing listed in the source.
• Runs scripts: no. Uses network: no (per the listing).
• Only test systems you own or have written permission to test.

Read the verification rule before you report findings

The skill states that a finding should only be recorded once a tool side effect is actually confirmed, for example an out-of-band callback or a file being read. A suspicion that an injection might work does not count on its own.

Use this rule to keep reports accurate. Record the evidence you captured, such as the callback received or the file content read, rather than the attempted payload alone.

Safety notes and limits

The content is written from an attacker's perspective and gives no mitigations. Developers looking for defensive hardening guidance should use a different resource. Do not use the skill against systems outside your authorised scope, as this could cause harm or legal trouble.

Keep test activity contained, record what you did, and stop when your scope ends.

• Not for systems you do not own or lack written permission to test.
• Not a defensive hardening guide; it includes no mitigations.
• Licence: Apache-2.0.