Open source · agent red-team skills

The playbook, as skills your agent can run

Because the offense is AI-driven, the methodology is a skill. Drop one into your agent (Claude Skills / agentskills.io / Hermes-compatible SKILL.md), point it at an agent you own, and it runs the test, confirms empirically, and writes an evidence-backed finding. Apache-2.0.

SKILL.md · portable · Apache-2.0 · 9
RT-1

Prompt injection

✓ validated live

Does content the agent processes hijack its task? Direct, indirect, multi-turn, obfuscated.

View SKILL.md →
RT-2

Tool / action abuse

✓ validated live

Coerced into an unintended tool call, hijacked arguments, or confused deputy.

View SKILL.md →
RT-3

Sandbox / isolation

Do tools run un-isolated? Does the sandbox silently disable itself?

View SKILL.md →
RT-4

Action-gating bypass

Can a high-risk action reach execution without out-of-band confirmation?

View SKILL.md →
RT-5

Channel injection

Can inbound channel content (DM / group / forward) steer the agent?

View SKILL.md →
RT-6

Memory poisoning

Does an injection persist into memory and fire in future sessions?

View SKILL.md →
RT-7

Supply chain

Can a poisoned skill / MCP / dependency become trusted instruction?

View SKILL.md →
RT-8

Data exfiltration

Can an injection move secrets / PII to an attacker sink?

View SKILL.md →
method

Cross-validation harness

Orchestrate static triage → dynamic confirmation. The arbiter is the exploit.

View SKILL.md →
◇Run these in your own agent

The same SKILL.md, loaded into your own agent, running the same tests against a target you own. Each comes with a real case — the advisory it produced.

Claude Code

SKILL.md · auto-discovered · or /plugin

Drop a skill into your skills dir (or install the whole toolkit as a plugin), then ask Claude Code to run it against an agent you own.

git clone https://github.com/William2333ZZ/trustshell
mkdir -p .claude/skills && cp -R trustshell/skills/redteam-an-agent .claude/skills/
# or install the whole toolkit as a plugin:
/plugin marketplace add William2333ZZ/trustshell
/plugin install trustshell
▸ "use the redteam-an-agent skill to red-team my agent at ./my-agent"
Case. This is exactly how we found TS-2026-004: Claude Code ran redteam-an-agent, drove a benign “summarize this note” task carrying an embedded shell command, and confirmed RCE by a marker on disk — reproduced 5/8, reported as ~60%, not “always”. Read advisory TS-2026-004 →

Any MCP client

MCP server · native tools

Run the TrustShell MCP server; your MCP client (Claude Desktop, Cursor, …) gets static_scan / red_team / list_skills as native tools.

git clone https://github.com/William2333ZZ/trustshell
python3 trustshell/mcp/trustshell_mcp.py   # then register it in your MCP client
▸ call static_scan(source="/path/to/agent"), then red_team(...) on the candidates
Case. static_scan over a framework’s source flagged the unsanitized inbound-filename path that became TS-2026-001 — which the dynamic pass then scoped honestly as a candidate (reachability unverified), not an overclaimed break. Read advisory TS-2026-001 →

Cursor & IDE assistants

SKILL.md as rules / context

Point the assistant at a SKILL.md as a rule/context file (or at the repo) and ask it to follow the relevant skill on the codebase in front of it.

# add trustshell/skills/audit-agent-code/SKILL.md to your rules/context, then:
▸ "follow audit-agent-code: review these channels for path traversal, command injection, and auth ordering"
Case. audit-agent-code is the framework-appsec method — cross-component consistency diff, auth ordering, fail-open controls, trust-boundary laundering. It’s the walk that surfaces gaps the LLM layer never sees.

Hermes · OpenClaw · agentskills.io

the same SKILL.md loads

The portable SKILL.md format loads directly (skills dir or marketplace import). Because the offense is AI-driven, the method travels with whatever agent runs it.

# drop the class you want into the host's skills directory:
cp -R trustshell/skills/rt1-prompt-injection  <host-skills-dir>/
cp -R trustshell/skills/rt6-memory-poisoning  <host-skills-dir>/
▸ "run rt1-prompt-injection against the target in a disposable sandbox"
Case. Host-agnostic by design: whatever runs SKILL.md can run the red-team. That’s how TrustShell spreads through the agent ecosystem — the method is portable, the advisories are the proof it works.
◇Every skill enforces these
  • Authorized targets only — an agent you own or have written permission to test.
  • Disposable environment only — never production, never a machine with real data.
  • Never handle the target's real credentials — reference by handle, never see the value.
  • Harmless proof only — a random marker, no destruction, no exfiltration, no persistence.
  • Method, not weapons — describe how to test and confirm, not ready-to-fire payloads.
  • Disclose to help defenders — publish the finding and the fix, never a weaponized payload; and if an agent defends well, say so.
Browse all skills on GitHub →Playbook