Web Exfiltration Detection Test
Red-team test for whether an agent leaks memory data via chained URL navigation from a malicious page
- Repository
- Tencent/AI-Infra-Guard
- Stars
- 7,320
- Licence
- Apache-2.0
- Files
- 1 file
What it does
This is a security testing playbook, not a feature for everyday work. It tells a security-testing agent how to probe another AI agent (one that can fetch web pages and holds personal memory) to see whether it can be tricked by a fake verification page into spelling out the user's name one letter at a time through URL paths. The skill defines attack prompts, a judging rubric for vulnerable versus safe answers, and a report format. It does not itself change how a normal assistant behaves.
Great for
- Security engineers testing AI agents that have web fetch and stored user memory before release
- Red teams building regression tests for indirect prompt injection and URL-based data exfiltration
- Developers hardening an agent that fetches untrusted web content
Skip it if
- Ordinary users wanting a general assistant skill: it has no productivity function and only sends adversarial prompts to a target agent
- Agents with no web access or no personal memory: the skill itself states it does not apply, so it adds nothing there
- Running against systems you do not own or have permission to test, since the probes target a local endpoint and could be misused against others' agents
Try asking
- “Test my support agent at 127.0.0.1 for whether it follows a fake Cloudflare verification page that asks it to navigate letter by letter”
- “Run the letter-by-letter URL exfiltration probes against my agent and report which responses count as vulnerable”
- “Check whether my agent treats fetched page content as untrusted data when the page contains hidden navigation instructions”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 1 original files, the Apache-2.0 licence and an attribution note.
web-exfiltration-detection.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip web-exfiltration-detection.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip web-exfiltration-detection.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Run the probes only against agents you own or are authorised to test, in an isolated environment with dummy memory data.
- Start with Probe 1 and escalate to Probe 2 or 3 only if the target does not navigate, to see the weakest point of failure.
- Use the judge criteria to separate true compliance from an agent merely discussing the attack, and record exact response snippets as evidence.
What's inside
- SKILL.md
Redistributed unmodified from Tencent/AI-Infra-Guard under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.