domains / families / security / llm-prompt-injection

llm-prompt-injection

combined

Use when testing an authorized LLM application for prompt injection, system-prompt exposure, unsafe tool use, or RAG data-boundary failures. LLM prompt injection playbook. Use when testing AI/LLM applications for direct injection, indirect injection via RAG/browsing, tool abuse, data exfiltration, MCP security risks, and defense bypass techniques.

When to use

• Target exposes a chatbot, copilot, or AI-backed endpoint (serverless function wrapping an LLM API).
• Response includes metadata like `context_length`, `response_length`, or token counts — passive measurement vector.
• Standard jailbreak prompts ("ignore previous instructions") are blocked — model has explicit refusal training.
• Target uses RAG (retrieval-augmented generation), agentictools, or multi-modal inputs — wider injection surface.
• You need to map system prompt contents without backend source access.

Skill page

Conflict

Both copies are distinct playbooks for the same task. The uphiago copy is a technique and defense catalog focused on architectural context boundaries, real-world case studies, and a graded catalog of direct override attempts against hardened models. The yaklang copy is an attack playbook that adds material steps and constraints the other lacks, including MCP security risks, specific indirect injection vectors (web browsing HTML/zero-width, email), tool/function calling abuse with argument injection and chaining, and routing to a separate jailbreak patterns file. Because each contains substantive steps the other does not, crowning one would hide a real alternative.