Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jd-opensource/JoySafeter --skill pentest-ai-llm-securitygit clone --depth 1 https://github.com/jd-opensource/JoySafeterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jd-opensource/joysafeter/pentest-ai-llm-security)<a href="https://agentmods.dev/skills/jd-opensource/joysafeter/pentest-ai-llm-security"><img src="https://agentmods.dev/badge/skills/jd-opensource/joysafeter/pentest-ai-llm-security/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jd-opensource/joysafeter/pentest-ai-llm-security"><img src="https://agentmods.dev/badge/skills/jd-opensource/joysafeter/pentest-ai-llm-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 27 This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.Fix: Remove or rewrite any text that instructs the agent to ignore prompts, override safety rules, or trust unverified content. Ensure skill content cannot be injected to alter agent behavior.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00040 | $0.00738 |
| Opus 5 | $0.00020 | $0.00369 |
| Sonnet 5 | $0.00008 | $0.00148 |
| Haiku 4.5 | $0.00004 | $0.00074 |
Grade B, and why
pentest-ai-llm-security scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Instruction-override phrasingmediumPrompt injection
Text telling the model to disregard its earlier instructions or safety rules is the shape of a prompt injection, whoever wrote it.
2. **Direct Prompt Injection**: Override system prompts, extract system prompt content, inject instructions that change model behavior. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 61 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Pentest AI/LLM Security
Purpose
AI-integrated applications introduce entirely new attack surfaces. Prompt injection is the "SQLi of AI." Neither Shannon nor any existing skill addresses this domain. OWASP LLM Top 10 (2025) defines the methodology.
Prerequisites
Authorization Requirements
- Written authorization with AI/LLM testing scope explicitly included
- Model access details — API endpoints, model versions, tool/function access
- Data sensitivity classification — what data the LLM can access
- Rate limit awareness — LLM API costs can escalate quickly
Environment Setup
- Garak for automated LLM vulnerability scanning
- Burp Suite for API interception of LLM requests/responses
- Python scripts for custom prompt injection payloads
- Local proxy to capture full request/response chains
Core Workflow
- Integration Point Discovery: Identify all LLM integration points — chat interfaces, content generation, RAG pipelines, AI search, code completion, summarization.
- Direct Prompt Injection: Override system prompts, extract system prompt content, inject instructions that change model behavior.
- Indirect Prompt Injection: Embed malicious instructions in documents/emails/web pages the LLM processes, poisoned RAG context.
- Data Exfiltration: Extract training data, PII from context windows, other users' conversation history, system config details.
- Insecure Output Handling: LLM output rendered as HTML (XSS via LLM), used in SQL queries (SQLi via LLM), used in system commands.
- Excessive Agency: LLM with tool access performing unauthorized actions, privilege escalation through tool chains, resource abuse.
- Classification: Document findings with OWASP LLM Top 10 (2025) classification and remediation guidance.
OWASP LLM Top 10 (2025) Coverage
| Category | Test Focus | Status |
|---|---|---|
| LLM01 Prompt Injection | Direct and indirect injection | ✅ |
| LLM02 Sensitive Information Disclosure | Data exfiltration, PII leakage | ✅ |
| LLM03 Supply Chain | Model provenance, plugin trust | ✅ |
| LLM04 Data and Model Poisoning | Training data integrity | ✅ |
| LLM05 Improper Output Handling | XSS/SQLi via LLM output | ✅ |
| LLM06 Excessive Agency | Unauthorized tool use | ✅ |
| LLM07 System Prompt Leakage | System prompt extraction | ✅ |
| LLM08 Vector and Embedding Weaknesses | RAG poisoning | ✅ |
| LLM09 Misinformation | Hallucination exploitation | ✅ |
| LLM10 Unbounded Consumption | Resource exhaustion | ✅ |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 61 lines · 40 tokens per session scan B 80b040759680
pentest-ai-llm-security is a skill published in the GitHub repository jd-opensource/JoySafeter (307 stars, last pushed 5d ago), licensed Apache-2.0. It adds 40 tokens to every session and 738 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (instruction-override phrasing). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
graphify
Use for any question about a codebase, its architecture, file relationships, or project content — especially when graphify-out/ exists, where the question should be treated as a graphify query first. Turns any input (code, docs, papers, images, videos) into a persistent knowledge graph with god nodes, community…
skill-authoring
Author SKILL.md skills: frontmatter, validator limits, structure.
swarmclaw
AI agent runtime and multi-agent orchestration platform. Teaches agents how to use SwarmClaw's 6 primitive tools, persistent memory, dreaming, delegation, connectors, credentials, and the skill system. Use when an agent is running on SwarmClaw and needs to understand the platform's capabilities.
image-prompt-optimizer
A skill focused on improving prompts for image-generation tools, with instructions covering its goals, process, outputs, and operating modes.
metaprompt
Generate a complete, ready-to-use prompt for a target model and harness. Triggers: metaprompt, generate a prompt for, write me a prompt, create a system prompt, prompt engineer this, optimize this prompt.
gh-issues
Fetch GitHub issues, spawn sub-agents to implement fixes and open PRs, then monitor and address PR review comments. Usage: /gh-issues [owner/repo] [--label bug] [--limit 5] [--milestone v1.0] [--assignee @me] [--fork user/repo] [--watch] [--interval 5] [--reviews-only] [--cron] [--dry-run] [--model glm-5]…