hunt-llm-ai

Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration via tool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10). Patterns: direct injection ('ignore previous instructions'), indirect injection via documents/web pages/email the model reads, ASCII smuggling (Unicode Tags block U+E0000-U+E007F, invisible to humans, decoded by the model), tool-use exfiltration (model has fetch/browse tool, attacker injects OOB URL, model exfils chat history/secrets), markdown-image zero-click exfil, system-prompt extraction, IDOR-via-AI (cross-tenant data). Targets: chatbots, RAG, summarizers, agentic copilots, MCP tools. Detection: any LLM-backed endpoint, doc upload triggering AI processing, autonomous agent with tools. Validate: OOB/Collaborator callback for exfil, verbatim-reproducible system-prompt leak (run twice), verifiable cross-tenant leak or RCE. Confabulation is NOT a finding. Use when hunting AI features, chatbots, RAG, agentic systems, MCP.

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A high-signal, highly actionable hunting playbook with strong validation workflows; its main weakness is progressive disclosure — a long monolithic SKILL.md that inlines material (ASI table, encoder, payload templates) that would benefit from being split into reference files.

Suggestions

Move the ASCII/Unicode Tags encoder/decoder into scripts/ (e.g. tags_smuggle.py) and keep only the usage pattern inline, so the harness is executable rather than copy-blocked.

Extract the ASI01–ASI10 table and the payload templates (markdown exfil, tool-use fetch, indirect-injection carriers) into references/ files, leaving SKILL.md as an overview that links one level deep — matching the 'security-arsenal' payload pack it already cites.

Trim the naming-note and webhook-alternative prose to tighten conciseness, or fold them into a references/notes.md so the main body stays lean.

Dimension	Reasoning	Score
Conciseness	Expert-targeted and largely lean, with executable payloads and code earning their tokens; the naming-note correction and webhook-alternative block are minor instances of over-explanation that could be trimmed.	4 / 5
Actionability	Copy-paste-ready throughout — concrete injection payloads, executable to_tags/from_tags encoder/decoder, Burp Collaborator and python http.server listener commands, and response-header fingerprints.	5 / 5
Workflow Clarity	The False-Positive Gate is an explicit five-check validation checklist with feedback loops (run-twice→discard on divergence, OOB callback→confirm exfil, verifiable cross-tenant artifact required), and each exfil channel is sequenced with its proof bar.	5 / 5
Progressive Disclosure	Well-sectioned with clear headers and signaled links to sibling skills, but with no bundle files the ~240-line body keeps the ASI table and the smuggling encoder inline where a references/ payload-pack or script would ease navigation.	3 / 5
	Total	17 / 20 Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A dense, highly specific third-person description that nails both the 'what' and the 'when' with concrete techniques and a clear 'Use when' trigger clause. Trigger-term coverage is strong but misses a few natural synonyms like 'LLM'.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'prompt injection, indirect injection, exfiltration via tool-use/markdown, ASCII smuggling... system-prompt extraction, IDOR-via-AI' — with comprehensive coverage of the LLM/AI bug-hunting surface.	5 / 5
Completeness	Explicitly answers both what (Patterns/Targets/Detection/Validate breakdown) and when ('Use when hunting AI features, chatbots, RAG, agentic systems, MCP') with concrete trigger phrases.	5 / 5
Trigger Term Quality	'Use when hunting AI features, chatbots, RAG, agentic systems, MCP' plus 'Targets: chatbots, RAG, summarizers, agentic copilots, MCP tools' gives good natural keyword coverage, though 'LLM' and several synonyms are absent from the trigger clause.	4 / 5
Distinctiveness Conflict Risk	Clear AI/LLM security niche with distinct triggers, but it name-drops overlapping primitives (SSRF, IDOR, XSS, RCE) that could cause it to surface for the sibling hunt-* skills.	4 / 5
	Total	18 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
relative_links	Relative link issues: 1 missing	Warning

	Total	14 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-llm-ai/SKILL.md
Commit: 646b72e

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.