The playbook, as skills your agent can run
Because the offense is AI-driven, the methodology is a skill. Drop one into your agent (Claude Skills / agentskills.io / Hermes-compatible SKILL.md), point it at an agent you own, and it runs the test, confirms empirically, and writes an evidence-backed finding. Apache-2.0.
Prompt injection
✓ validated liveDoes content the agent processes hijack its task? Direct, indirect, multi-turn, obfuscated.
Tool / action abuse
Coerced into an unintended tool call, hijacked arguments, or confused deputy.
Sandbox / isolation
✓ validated liveDo tools run un-isolated? Does the sandbox silently disable itself?
Action-gating bypass
Can a high-risk action reach execution without out-of-band confirmation?
Channel injection
Can inbound channel content (DM / group / forward) steer the agent?
Memory poisoning
✓ validated liveDoes an injection persist into memory and fire in future sessions?
Supply chain
Can a poisoned skill / MCP / dependency become trusted instruction?
Data exfiltration
Can an injection move secrets / PII to an attacker sink?
Cross-validation harness
Orchestrate static triage → dynamic confirmation. The arbiter is the exploit.
- Authorized targets only — an agent you own or have written permission to test.
- Disposable environment only — never production, never a machine with real data.
- Never handle the target's real credentials — reference by handle, never see the value.
- Harmless proof only — a random marker, no destruction, no exfiltration, no persistence.
- Method, not weapons — describe how to test and confirm, not ready-to-fire payloads.
- Responsible disclosure — report privately with a fix; if an agent defends well, say so.