hunt-llm-ai

Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration via tool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10). Patterns: direct injection ('ignore previous instructions'), indirect injection via documents/web pages/email the model reads, ASCII smuggling (Unicode Tags block U+E0000-U+E007F, invisible to humans, decoded by the model), tool-use exfiltration (model has fetch/browse tool, attacker injects OOB URL, model exfils chat history/secrets), markdown-image zero-click exfil, system-prompt extraction, IDOR-via-AI (cross-tenant data). Targets: chatbots, RAG, summarizers, agentic copilots, MCP tools. Detection: any LLM-backed endpoint, doc upload triggering AI processing, autonomous agent with tools. Validate: OOB/Collaborator callback for exfil, verbatim-reproducible system-prompt leak (run twice), verifiable cross-tenant leak or RCE. Confabulation is NOT a finding. Use when hunting AI features, chatbots, RAG, agentic systems, MCP.

Quality

96%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

92%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a high-quality, executable bug-hunting runbook with a strong validation gate and concrete payloads across every attack class. Its only structural weakness is progressive disclosure: the material is large enough to warrant splitting into reference files rather than living entirely inline.

Suggestions

Extract the ASI01-ASI10 agentic-security table into a references/ file (e.g. agentic-asi.md) and summarize it inline with a one-level-deep link, reducing SKILL.md length and improving navigability.

Move the ASCII/Unicode Tags smuggling encoder/decoder harness and variant filters into a bundled script or references/ file (e.g. ascii-smuggling.md), keeping only the core concept and a pointer in the main body.

Split the detailed exfiltration-channel payloads (markdown-image, tool-use, DNS-only) into an exfil-channels.md reference, leaving the main body with the OOB-proof gate and a per-channel link.

Dimension	Reasoning	Score
Conciseness	The body is payload-dense and assumes Claude's competence — it never explains what an LLM or OWASP is — and every section contributes actionable material; the minor 'Naming note (was wrong in v1)' housekeeping is justified for correctness, keeping it at the lean score-3 anchor rather than 2.	3 / 3
Actionability	Provides fully executable artifacts — the to_tags/from_tags Python encoder/decoder, Burp MCP collaborator commands, concrete injection strings, and an OOB listener snippet — all copy-paste ready, matching the score-3 anchor.	3 / 3
Workflow Clarity	The False-Positive Gate is an explicit sequenced checklist with validation checkpoints and feedback loops (run-twice-then-discard, OOB-callback-required, control-account comparison), and each attack class states its proof bar, matching the score-3 anchor for clear sequence with validation.	3 / 3
Progressive Disclosure	No bundle files exist and everything is inline in one ~200-line SKILL.md; sections are well-organized but content that could be split (the ASI01-ASI10 table, the ASCII-smuggling harness, the exfil channels) is monolithic with no one-level-deep reference files, matching the score-2 anchor where 'content that should be separate is inline' rather than the score-3 anchor requiring well-signaled references.	2 / 3
	Total	11 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, trigger-rich, and explicitly answers both what it does and when to invoke it in third-person voice, hitting the top anchor on every dimension. It is dense, but the density is concrete payload/proof vocabulary rather than fluff.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'prompt injection, indirect injection... ASCII smuggling... tool-use exfiltration... markdown-image zero-click exfil, system-prompt extraction, IDOR-via-AI' — matching the score-3 anchor for comprehensive concrete actions, not score 2 because coverage is broad and specific.	3 / 3
Completeness	Clearly answers both what ('Hunt LLM/AI feature bugs — prompt injection...') and when ('Use when hunting AI features, chatbots, RAG, agentic systems, MCP.') with an explicit trigger clause; uses third-person voice so no voice penalty applies.	3 / 3
Trigger Term Quality	Includes natural user terms ('chatbots, RAG, summarizers, agentic copilots, MCP tools') plus an explicit 'Use when hunting AI features, chatbots, RAG, agentic systems, MCP' trigger clause, giving good coverage of phrasing a user would actually say.	3 / 3
Distinctiveness Conflict Risk	Occupies a clear niche (LLM/AI feature bug hunting) with distinct, domain-specific triggers unlikely to fire for general-purpose skills, matching the score-3 'clear niche' anchor.	3 / 3
	Total	12 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
relative_links	Relative link issues: 1 missing	Warning

	Total	14 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-llm-ai/SKILL.md
Commit: 6b9c96e

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.