prompt-injection

Hunt LLM prompt injection and tool-call hijacking in modern AI-integrated applications (CWE-1427). Covers indirect injection via RAG, tool abuse, exfiltration chains, and jailbreak-to-RCE pivots on agentic systems.

Quality

69%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/analyst/prompt-injection/SKILL.md

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The playbook is highly actionable and token-efficient, with executable discovery commands and copy-paste payloads, but its workflow is laid out as topical sections rather than an explicitly sequenced process with validation checkpoints. Promoting the audit → exploit → validate flow into a numbered, checkpointed workflow would raise the weakest dimension.

Suggestions

Reframe the audit workflow as an explicit numbered sequence (inventory → find call sites → test injection vectors → validate finding → score CVSS → chain promotion) with the validate_finding contract wired in as a mandatory checkpoint before reporting.

Add a short feedback loop after validation ('If success_patterns absent but negative_patterns match, retry with a refined payload; if neither, mark not-vulnerable').

Trim the editorial intro ('bug bounty payouts are high...', 'the real money') to recover tokens without losing substance.

Dimension	Reasoning	Score
Conciseness	The body is lean and assumes Claude's competence (no 'what is an LLM' preamble), with executable grep and payloads earning their tokens; minor editorial padding ('the real money', the bounty-payout intro, the 'just say it out loud' aside) keeps it just below a 5.	4 / 5
Actionability	Guidance is fully executable and copy-paste ready: runnable grep -rE commands for call-site discovery, concrete PoC payloads (HTML comment exfil, RAG poisoning, tool-call hijack, markdown image exfil), and a CVSS vector table covering the common variants.	5 / 5
Workflow Clarity	Sections are topically ordered (inventory → vectors → audit → goals → PoC → validate → CVSS → chains) and a validate_finding contract exists, but the audit workflow is not presented as an explicitly numbered sequence with validation wired in as a checkpoint, and this destructive/exploitation skill lacks an inline validate-then-fix feedback loop.	3 / 5
Progressive Disclosure	Content is well-organized into eight clearly headed numbered sections and is self-contained with no bundle files to reference; the inlined PoC payload and CVSS tables are reasonable for a playbook, with only minor organization gaps keeping it below 5.	4 / 5
	Total	16 / 20 Passed

Description

62%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and occupies a clear, distinctive niche, but it omits explicit 'when to use' guidance and relies on jargon-heavy trigger terms rather than natural user phrasing. Adding a 'Use when...' clause with conversational keywords would lift the weaker dimensions.

Suggestions

Append an explicit 'Use when...' clause, e.g. 'Use when testing AI/LLM applications for prompt injection, tool-call hijacking, RAG poisoning, or jailbreak-to-RCE chains.'

Soften jargon in the trigger terms by adding natural synonyms users actually say (e.g. 'AI chatbot security', 'LLM jailbreak', 'agent tool abuse') alongside CWE-1427.

Keep the concrete coverage list but lead with the single most recognizable action ('Hunt prompt injection...') so the primary capability reads as an action, not a topic catalogue.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions and coverage areas ('Hunt LLM prompt injection and tool-call hijacking', 'Covers indirect injection via RAG, tool abuse, exfiltration chains, and jailbreak-to-RCE pivots'), though they are framed as covered topics rather than distinct operations, leaving a minor gap versus comprehensive.	4 / 5
Completeness	It clearly states what the skill does ('Hunt LLM prompt injection...') but provides no 'Use when...' clause or explicit trigger guidance, capping completeness at 3 per the rubric guideline.	3 / 5
Trigger Term Quality	Domain-accurate terms ('prompt injection', 'tool-call hijacking', 'RAG', 'jailbreak-to-RCE') are present but the description leans on jargon and a CWE code ('CWE-1427'), missing the natural synonyms and variations a user would actually say.	3 / 5
Distinctiveness Conflict Risk	The CWE-1427 prompt-injection/tool-call-hijack niche is sharply defined with distinct triggers and minimal overlap risk against other skills.	5 / 5
	Total	15 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/analyst/prompt-injection/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.