Skip to content
Get packs

AI Pentest Checklist

Gives the agent a structured checklist for security testing of AI and LLM systems

Source Download skill
Repository
SnailSploit/Claude-Red
Stars
10,230
Licence
MIT
Files
1 file

What it does

This skill gives an AI agent a detailed offensive-security checklist for AI and LLM systems, covering prompt injection, jailbreaks, model extraction, training data poisoning, RAG poisoning, insecure output handling, and supply chain risks. When it is active, the agent works through the checklist in order, considers which techniques apply to a given target, tracks what has been covered, and suggests next steps. It is a methodology document rather than an automated scanner; it names tools such as garak and LLMFuzzer but the files do not include or run them.

Great for

  • Security engineers preparing an authorised red-team or penetration test of an LLM application
  • Developers who want a checklist of AI-specific attack categories to review their own chatbot or RAG system
  • Students or researchers learning the vocabulary and mechanisms of LLM attacks

Skip it if

  • Testing systems you do not own or have written permission to test, because the checklist is written for active exploitation and could cause real harm or break laws
  • Non-technical users looking for a finished security report, since the skill gives a methodology but does not verify any system by itself
  • Production sign-off decisions, because the checklist is high-level and some sections, such as regulatory references, are summaries rather than audit criteria

Try asking

  • “Use the AI pentest checklist to plan an authorised assessment of our customer support chatbot's prompt injection exposure”
  • “Walk me through the RAG poisoning checks for our document search system and track which items we have covered”
  • “Which LLM attack vectors apply to an agent that can send emails and query a database?”
  • “Help me map trust boundaries and tool permissions for our internal LLM assistant”
Step-by-step guide: how to use AI Pentest ChecklistInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    offensive-ai-security.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip offensive-ai-security.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip offensive-ai-security.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Always state the scope and written authorisation for the target at the start, so the agent keeps its work within an approved engagement
  • Give the agent a description of the target architecture (model, tools, data sources) so it can pick the relevant checklist items instead of working through everything
  • Verify any tool names, regulatory references or links the agent cites against current official documentation, since the skill text is a snapshot

What's inside

  • SKILL.md

Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.