Guide · Agent skill
How to use the LLM Security Testing agent skill (llm-security)
Updated · written with AI from the project's own documentation and checked against our catalogue data
The llm-security skill is a set of instructions that teaches an AI coding agent how to run a structured security assessment of LLM applications, chatbots, RAG systems and tool-using AI agents. It is written for people who are authorised to test the system in front of them, such as security engineers and developers checking their own app before release. After this guide you will know what the skill covers, how to install it from the ZIP, how to ask for it in natural language, and what to check before you run anything.
LLM Security Testingzhaoxuya520/reverse-skill · MIT Download the skill Quick start
- 1Download and unzip the skill. Download the ZIP from this page and unzip it so that SKILL.md and the references folder are together in one skill folder.
- 2Place it in the skills folder. Move the folder into ~/.claude/skills/ for personal use or into the project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Confirm authorisation and scope. Write down the system you are allowed to test and the limits of that permission before you start.
- 4Ask in plain language. Describe the task, for example a prompt injection test of your support chatbot, and state that you have permission to test it.
- 5Map the attack surface. Let the agent list entry points, registered tools, data flows and any human approval steps in the target.
- 6Run the tests and record evidence. Work through the injection, tool-misuse, poisoning and output-handling checks, saving commands and results as you go.
What is an agent skill and what does llm-security make the agent do?
An agent skill is a folder with a SKILL.md file that an AI agent reads when a task matches the skill's description. This one is named llm-security and its description says it is for authorised security assessment of LLM applications and AI agents, including prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.
Once installed, the agent follows a playbook. It maps the attack surface of the target, then tries prompt injection (direct, role-play, encoding tricks, multi-turn extraction and hidden instructions in web pages or documents). It also tests whether an agent can be pushed into misusing its tools, checks whether a knowledge base or memory can be poisoned, and inspects whether model output is unsafe when passed to browsers, databases or shells. The playbook is organised around OWASP LLM Top 10 and Agentic AI Top 10 categories.
- Reconnaissance: list entry points, registered tools and data flows
- Prompt injection tests, graded from direct overrides to indirect injection
- Tool abuse, memory and RAG poisoning, and output handling tests
- System prompt extraction, with canary-token checks for defences
How do you install the llm-security skill?
Download the ZIP for the skill from this page and unzip it. The skill folder should contain SKILL.md and a references folder. Then place it in one of these locations: the personal skills folder ~/.claude/skills/, or a project's .claude/skills/ folder if you want it available only inside that project.
If you use the Claude apps instead of a local folder, upload the skill under Settings → Capabilities → Skills.
- Personal: unzip into ~/.claude/skills/
- Per project: unzip into the project's .claude/skills/
- Claude apps: Settings → Capabilities → Skills, then upload
How do you trigger the skill with a natural request?
You do not need a special command. Describe the authorised task in plain words and mention the system you are testing. The agent matches your request against the skill's description, so requests that name prompt injection, tool misuse, RAG poisoning or an OWASP LLM Top 10 review are the most likely to load it.
State the scope and authorisation in the same message. The skill's own notes say to confirm the task falls within its scope before acting, so give the agent that context up front.
- "Use the llm-security skill to test our support chatbot for prompt injection. We have written permission to test it."
- "Check whether our RAG knowledge base can be poisoned by a malicious document. This is our staging instance."
- "Run an OWASP LLM Top 10 style review of our tool-using agent and list the evidence for each finding."
- "Give me a checklist of tool-misuse cases to run against our app before release."
What does the agent need before it can test?
The skill needs access to the target LLM application or agent under test, since every test is run against it. Its reference files must be in the skill folder. Some optional tools are used by the playbook: garak and PyRIT need Python and pip, and promptfoo needs Node.js and npm. The source lists the install commands pip install garak, pip install pyrit and npm install -g promptfoo.
Be aware that SKILL.md also refers to files outside this skill folder: ../ops, ../tool-index.md and ../field-journal. These are not included in the ZIP, so some instructions may point to paths that do not exist on your machine.
- Access to the target system you are authorised to test
- Python and pip for optional garak and PyRIT
- Node.js and npm for optional promptfoo
- Note: external paths referenced in SKILL.md are not included in the skill folder
pip install garak
pip install pyrit
npm install -g promptfooWhat safety precautions should you take?
This skill contains attack techniques. Its steps are meant only for systems you own or have written permission to test. Testing anything else can cause harm or breach terms of service.
The skill uses network access, and some payloads, such as exfiltration to an external address or shell command injection, should only be run in an isolated environment. The skill does not run scripts itself, but the optional tools it points to are separate programs you install and run. Do not run production systems without a sandbox.
- Only test systems you own or have written permission to test
- Run exfiltration and shell-injection payloads only in isolated environments
- Do not test production systems without a sandbox
- Keep a record of commands and outputs as reproducible evidence
What people use it for
- Red-teaming a customer support chatbot for direct and indirect prompt injection before launch
- Checking whether an AI agent with email or database tools can be pushed into chaining them in unintended ways
- Testing whether a RAG knowledge base accepts a malicious document and returns it in answers
- Building an evidence pack for an OWASP LLM Top 10 style review of an internal AI feature
Frequently asked questions
Is the llm-security skill free to use?
The source lists the skill under the MIT licence, which is stated in the item details on this page. Optional tools such as garak, PyRIT and promptfoo are separate projects with their own installation steps.
How do I install the llm-security skill in Claude?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. In the Claude apps you can instead upload it under Settings → Capabilities → Skills.
What do I need to run llm-security?
You need access to the LLM application or agent you are authorised to test and the reference files in the skill folder. Optional tools need Python and pip for garak and PyRIT, or Node.js and npm for promptfoo.
Does llm-security run scripts on my computer?
The listing says the skill runs no scripts and does use the network. Optional tools you install separately may make network calls, so run risky payloads in an isolated environment.
Why does SKILL.md mention files that are missing?
SKILL.md refers to ../ops, ../tool-index.md and ../field-journal, which are not included in the skill folder. The core reference files are included, so the agent may not be able to follow instructions that depend on those missing paths.
How does llm-security compare with garak or promptfoo?
garak, PyRIT and promptfoo are testing tools that run attacks. llm-security is a set of instructions that guides an agent through a structured assessment, and it points to those tools as optional parts of the workflow.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use llm-security if you are a security engineer or developer who is authorised to test an LLM feature or AI agent and wants a structured checklist of prompt injection and tool-misuse cases. Pick something else if you want a general AI safety overview, or if you need to test systems you do not own or have written permission to test.
Download the skill