CtrlK
BlogDocsLog inGet started
Tessl Logo

aatmf-t01-prompt-injection

AATMF T1 — Prompt & Context Subversion. Direct + indirect prompt injection, ASCII smuggling, payload-in-image, prompt-leaking via reflection.

62

Quality

74%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/plugins/llm-redteam/t01-prompt-injection/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a tight, well-structured reference catalog with concrete payloads, an executable promptfoo config, and clear detection/severity/defender sections. It assumes Claude's competence and avoids padding, with only minor actionability and feedback-loop gaps in a few technique subsections.

Suggestions

Add an executable probe snippet (e.g. a one-line promptfoo command) to the 'Probe pattern' section so the workflow can be launched directly.

For T1.004 (payload in image) and T1.005 (adversarial typography), include a small concrete generation/check command rather than only descriptive bullets.

Consider a brief validate step in the probe workflow (e.g. how to confirm a flagged result is a true positive) to strengthen the feedback loop.

DimensionReasoningScore

Conciseness

Lean and efficient throughout — canonical payloads, a tight promptfoo YAML, and a compact ASCII-smuggling snippet with no padding of concepts Claude already knows; every section earns its place.

5 / 5

Actionability

Provides executable artifacts (copy-paste promptfoo redteam config, runnable Python for Unicode tag smuggling, concrete payloads) but some technique sections (T1.004, T1.005) are descriptive rather than giving directly executable test code.

4 / 5

Workflow Clarity

The probe-pattern section sequences testing (plugins + strategies) and the detection-signals section gives clear pass/fail criteria, but there is no explicit validate→fix→retry feedback loop; acceptable since this is a reference catalog rather than a destructive batch operation.

4 / 5

Progressive Disclosure

Single well-organized file (no bundle directories exist) with clear section headers (Techniques, Probe pattern, Detection signals, Severity, Defender, Cross-references) giving easy navigation; minor gap is that some technique detail could live in reference files but the size is reasonable.

4 / 5

Total

17

/

20

Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and well-keyworded, clearly identifying the prompt-injection subdomain with concrete technique names. Its main weakness is the absence of an explicit 'Use when...' trigger clause, which caps its completeness score.

Suggestions

Add an explicit trigger clause, e.g. 'Use when testing LLMs for prompt injection, context subversion, or indirect injection via RAG/email/web content.'

Include a couple of plain-language synonyms users might say (e.g. 'jailbreak attempts', 'ignore-previous-instructions attacks') alongside the technical terms.

Consider mentioning common file/trigger contexts (e.g. 'when auditing system-prompt robustness or agent tool-call safety') to broaden natural discovery.

DimensionReasoningScore

Specificity

Lists several concrete actions — 'Direct + indirect prompt injection, ASCII smuggling, payload-in-image, prompt-leaking via reflection' — giving specific capability coverage rather than vague abstraction, though slightly short of fully comprehensive.

4 / 5

Completeness

Provides a clear 'what' (the named sub-techniques) but lacks any explicit 'Use when...' trigger clause, so per rubric guidance completeness is capped at 3.

3 / 5

Trigger Term Quality

Includes natural keywords a user might say ('prompt injection', 'ASCII smuggling', 'rag injection', 'input') with good coverage, but leans somewhat technical and misses a few common synonyms.

4 / 5

Distinctiveness Conflict Risk

Occupies a clear niche (AATMF T1 prompt & context subversion) with distinct triggers and minimal overlap with other skills, though the taxonomy prefix may be unfamiliar.

4 / 5

Total

15

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.