llm-security

Use for authorized security assessment of LLM applications and AI agents, including prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/llm-security/SKILL.md

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, highly actionable security-testing skill with copy-paste payloads and a clear sequenced workflow. Its main weaknesses are missing per-step validation checkpoints for destructive operations and scattered external cross-references that are not part of the bundle.

Suggestions

Add explicit validate-and-verify checkpoints inside each workflow step (e.g., confirm authorization before attacking, verify payload reached the model, record reproducible evidence per step) rather than only a final self-check.

Consolidate or mark the external '../ops/...', '../field-journal/...', and '../tool-index.md' references so readers can distinguish in-bundle material from cross-skill dependencies.

Move the long level-1–5 injection payload catalog into a reference file and keep SKILL.md as an overview with a representative example, improving token efficiency on load.

Dimension	Reasoning	Score
Conciseness	The body is mostly lean — checklists, tables, and copy-paste payloads with no padding explaining what prompt injection is — but the 'ACTION REQUIRED' orchestration preamble and final self-check add length that could be trimmed slightly.	4 / 5
Actionability	Provides copy-paste-ready injection payloads across five difficulty levels ('Ignore all previous instructions...', Base64/Unicode/zero-width strings, multi-round extraction), concrete install commands ('pip install garak', 'pip install pyrit', 'npm install -g promptfoo'), and specific tool-chaining examples covering common cases.	5 / 5
Workflow Clarity	A clear six-step sequence (recon → prompt injection → tool abuse → memory poisoning → output security → prompt extraction) is present with a final self-check, but there are no per-step validation/feedback loops for what are inherently destructive attack operations, capping the score per the destructive-operations guidance.	3 / 5
Progressive Disclosure	The '参考' section cleanly signals one-level-deep references (owasp-llm-top10.md, prompt-injection-methodology.md, agent-security-testing.md, agent-obedience-engineering.md — all real files), but inline cross-skill paths like '../ops/skill-supply-chain.md', '../field-journal/precedent-pentest.md', and '../tool-index.md' are external to the bundle and muddy navigation.	4 / 5
	Total	16 / 20 Passed

Description

78%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description with a clear 'Use for' trigger and a well-scoped AI-security niche. It could be tightened by adding more concrete action verbs and a few common user phrases like 'red team' or 'jailbreak'.

Suggestions

Add explicit action verbs (e.g., 'Probe, fuzz, and red-team') so the 'what' reads as concrete actions rather than one verb over a list of risk areas.

Expand the 'when' clause with concrete user phrases such as 'when the user asks to red-team an LLM, jailbreak an AI agent, or test a RAG pipeline for injection'.

Include common synonyms users say ('red team', 'jailbreak', 'AI security') to broaden trigger coverage.

Dimension	Reasoning	Score
Specificity	Names the domain ('authorized security assessment of LLM applications and AI agents') and enumerates several concrete risk areas — 'prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks' — but the only action verb is 'assessment' applied across those areas, leaving minor gaps in distinct concrete actions.	4 / 5
Completeness	Opens with a 'Use for...' clause giving the 'when' and states the 'what' (security assessment of LLM/AI agents covering listed risks), but the trigger phrasing could be more explicit with concrete user-facing situations.	4 / 5
Trigger Term Quality	Includes natural terms a user would say such as 'LLM applications', 'AI agents', 'prompt injection', and 'RAG exposure', but misses common variations like 'red team', 'jailbreak', or 'AI security'.	4 / 5
Distinctiveness Conflict Risk	The AI/LLM-specific niche and distinctive triggers (prompt injection, RAG exposure, memory poisoning, model supply-chain) make it unlikely to fire for a non-AI security skill.	5 / 5
	Total	17 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zhaoxuya520/reverse-skill
Path: skills/llm-security/SKILL.md
Commit: 3ae5c59

Reviewed: ~2 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.