CtrlK
BlogDocsLog inGet started
Tessl Logo

system-prompt-leakage

Hunt LLM system-prompt leakage (OWASP LLM07:2025) — exfiltration of the privileged system prompt revealing internal rules, secrets baked in, tool inventory, and business logic that should not be client-visible.

64

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/analyst/system-prompt-leakage/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with copy-paste grep commands and payloads, a clear ordered methodology, and a validation contract, suffering only from minor conciseness padding and the absence of an explicit retry feedback loop, making it a strong but not perfect skill body.

Suggestions

Tighten the opening paragraph and remove parenthetical asides (e.g., the 'Models often quote the rule verbatim...' note) to push conciseness toward anchor 5.

Add an explicit validate-then-retry loop to the audit workflow (e.g., 'Run the negative_command; if success_patterns still match the leaked text, mark confirmed; if negative_patterns appear, mark a false positive and re-run with a fresh account') to lift workflow_clarity.

If the skill grows, split the PoC payload catalogue and CVSS tables into references/payloads.md and references/cvss.md with one-level-deep links to keep the overview lean.

DimensionReasoningScore

Conciseness

Dense and information-rich with no beginner concept padding, but retains a few trimmable asides (e.g., 'This finding type is the highest-yield reconnaissance step on any LLM engagement — do it before anything else.' and parentheticals like '(Models often quote the rule verbatim while declining to break it.)'), matching anchor 4's 'efficient; minor instances of over-explanation that could be trimmed' rather than the fully lean anchor 5.

4 / 5

Actionability

Provides copy-paste-ready grep commands, concrete payload strings in fenced blocks, a reflected-via-tool-argument example, a validate_finding contract with success/negative patterns, and CVSS vectors covering the common cases, matching anchor 5's 'fully executable; copy-paste ready code or commands; specific examples cover the common cases'.

5 / 5

Workflow Clarity

A clear ordered methodology (recognition → attack vectors → audit workflow → exploitation → PoC → validate → CVSS → chain) with an audit checklist and a validate_finding contract acting as a verification step, but lacks an explicit feedback-loop (run → check output → fix → retry), fitting anchor 4's 'clear sequence with most checkpoints present; minor validation gaps' rather than the explicit-retry anchor 5.

4 / 5

Progressive Disclosure

Single self-contained file with no bundle references, organized into 8 well-signaled numbered sections; content is appropriately placed for a single-file skill but exceeds the ~50-line simple-skill threshold where some payload catalogues/CVSS tables could plausibly be split out, matching anchor 4's 'good structure; most content appropriately placed; minor organization gaps'.

4 / 5

Total

17

/

20

Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, distinctive, and uses strong natural trigger terms for its security-testing niche, but it omits an explicit 'Use when...' clause, which caps completeness at 3 and leaves the description slightly below a top-tier score.

Suggestions

Add an explicit 'Use when...' clause (e.g., 'Use when testing LLM interfaces for system-prompt disclosure, OWASP LLM07:2025 findings, or when a target exposes a chatbot/copilot/agent surface') to lift completeness.

Soften jargon ('exfiltration', 'privileged system prompt') with a couple of natural synonyms a non-specialist might say ('leaking the hidden instructions', 'revealing the bot's rules') to broaden trigger-term coverage.

Consider framing 2-3 distinct concrete actions (hunt, extract, validate) rather than one 'hunt/exfiltrate' action to push specificity toward anchor 5.

DimensionReasoningScore

Specificity

Names the domain and a concrete primary action ('Hunt... exfiltration of the privileged system prompt') plus a comprehensive list of what is uncovered ('internal rules, secrets baked in, tool inventory, and business logic'), but centers on a single action rather than multiple distinct ones, fitting the anchor-4 example of several specific actions with minor gaps rather than the multi-action anchor 5.

4 / 5

Completeness

Provides a clear 'what' (hunt/exfiltrate system-prompt leakage revealing rules, secrets, tool inventory, business logic) but no explicit 'Use when...' trigger clause in the description itself; per the judging guideline a missing 'Use when...' clause caps completeness at 3, exactly matching anchor 3.

3 / 5

Trigger Term Quality

Includes natural terms a tester would say ('LLM system prompt leakage', 'OWASP LLM07', 'secrets', 'tool inventory', 'business logic', 'client visible') with good coverage, but leans technical ('exfiltration', 'privileged system prompt') and lacks synonym-level breadth, matching anchor 4 rather than the fully comprehensive anchor 5.

4 / 5

Distinctiveness Conflict Risk

Occupies a clear niche ('LLM system-prompt leakage (OWASP LLM07:2025)') with distinctive, specific triggers that would not fire for unrelated skills, matching anchor 5's 'clear niche with distinct triggers; minimal conflict risk'.

5 / 5

Total

16

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.