prompt-injection-audit

Contents

• Scope & authorization (blast-radius labels)
• Model endpoint or agent application: when to use a scanner instead
• Phase 0 - target profile: what is even reachable
• Phase 1 - oracle and channel setup, with the canary gate
• Phase 2 - technique-family triage
• Phase 3 - matrix run
• Phase 4 - judged objectives
• False-positive gates
• Output
• Reference files: references/technique-matrix.md, references/delivery-channels.md, references/results-schema.md

Scope & authorization

Only run against an LLM application you own or are contractually engaged to test. This skill makes a target agent take actions its operator did not intend, so the authorization has to name the agent, its tools, and the accounts it acts as - not just the web app in front of it.

Blast-radius labels:

• Passive (phase 0) - profiling. Reads the app's own surface and documentation.
• Active-3rdparty (phase 1) - stands up a callback host and arms a channel. Payload content reaches your own infrastructure.
• Active (phases 2-4) - the target agent executes injected instructions. Anything it can do, a landed payload can do.

Two objectives need their own sign-off before you run them. Memory poisoning persists past the engagement window and needs an agreed cleanup step. Token exhaustion is resource exhaustion against a metered service: get it in writing, cap it, run it off-peak, or skip it and record it as skipped.

Model endpoint or agent application

Decide this before anything else, because it decides whether this skill is the right instrument.

A raw model endpoint - you hold an API key and send prompts directly - is scanner work. Corpus scanners such as Praetorian's Augustus carry hundreds of probes across dozens of provider bindings and score them with maintained detectors. Point one at the endpoint and take the result. Do not hand-roll a corpus here; a payload library frozen in markdown goes stale against the next model revision, and breadth is not what a methodology skill adds.