Borrowing it
Nothing to install: this file belongs to zhaji2333/CkSKILLS. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/zhaji2333/CkSKILLS/main/.agents/skills/ai-llm-agent-security/SKILL.mdgit clone --depth 1 https://github.com/zhaji2333/CkSKILLSWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zhaji2333/ckskills/ai-llm-agent-security)<a href="https://agentmods.dev/skills/zhaji2333/ckskills/ai-llm-agent-security"><img src="https://agentmods.dev/badge/skills/zhaji2333/ckskills/ai-llm-agent-security/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zhaji2333/ckskills/ai-llm-agent-security"><img src="https://agentmods.dev/badge/skills/zhaji2333/ckskills/ai-llm-agent-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00150 | $0.10110 |
| Opus 5 | $0.00075 | $0.05055 |
| Sonnet 5 | $0.00030 | $0.02022 |
| Haiku 4.5 | $0.00015 | $0.01011 |
Grade A, and why
ai-llm-agent-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 681 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ai-llm-agent-security — AI / LLM / Agent 安全专项深度挖掘
本技能以 OWASP LLM Top 10 (2025) 为骨架，结合实战打法，覆盖从提示词层到 Agent 工具层、从数据层到模型供应链层的完整攻击面。
何时调用（触发条件）
- 目标含 LLM 后端：Chatbot、智能客服、AI 助手、Copilot、AI 写作/编程/搜索/问答
- 用户输入进入大模型提示词（直接对话、模板填充、系统消息拼接）
- 用户输入进入 Agent 工具调用（function calling、代码解释器、shell 执行、浏览器、文件读写、SQL 执行、API 调用）
- 系统含 RAG 知识库（向量检索、文档问答、Embedding、向量库 Milvus/Pinecone/Chroma/pgvector）
- 系统含 对话记忆（多轮上下文、长期记忆、跨会话持久化、用户画像）
- 系统含 文件/URL 解析喂入 LLM（PDF/Word/网页/邮件/图片 OCR）
- 目标暴露模型服务（OpenAI 兼容 API、HuggingFace 推理、vLLM/Ollama 本地部署）
- 出现 LLM 输出回显前端、LLM 输出进入下游执行（渲染/存储/SQL/命令）
- 需要测试 越狱（Jailbreak）/护栏绕过/System Prompt 泄露/敏感信息泄露
- 需要测试 RAG 投毒 / Agent 记忆污染 / 工具滥用 / 沙箱逃逸
一、攻击面与信任边界建模（先建模再动手）
┌─────────────────────────────────────────────────────────────┐
│ 攻击面分层（自上而下，越下层危害越大） │
├─────────────────────────────────────────────────────────────┤
│ L1 提示词层 : 用户输入 → System Prompt / 对话上下文 │
│ L2 模型层 : 训练数据泄露 / 幻觉 / 不当输出 │
│ L3 输出层 : LLM 输出 → 前端渲染 / 下游执行（XSS/SQL/RCE） │
│ L4 检索层 : RAG 知识库 / 向量库 / Embedding │
│ L5 记忆层 : 短期上下文 / 长期记忆 / 用户画像 / 跨会话 │
│ L6 工具层 : Function Calling / 代码解释器 / Shell / 浏览器 │
│ L7 沙箱层 : 代码沙箱 / 工具执行环境 / Agent 运行时 │
│ L8 供应链层 : 模型权重 / 插件 / 依赖库 / 第三方模型 API │
└─────────────────────────────────────────────────────────────┘
五问建模：
- 用户输入经过几道处理进入 LLM？是否可被截断/拼接/覆盖？
- LLM 能调用哪些工具？哪些有副作用（写文件/执行命令/发请求/改数据库）？
- 知识库数据来源是否可信？用户能否写入知识库内容？
- 对话记忆是否跨会话持久化？历史消息能否被污染？
- LLM 输出流向哪里？前端渲染？下游执行？是否做净化？
二、OWASP LLM Top 10 (2025) 全景速查
| 编号 | 风险 | 本技能章节 | 危害等级 |
|---|---|---|---|
| LLM01 | 提示词注入（Prompt Injection） | 三 | 严重 |
| LLM02 | 敏感信息泄露 | 五 | 严重 |
| LLM03 | 供应链 | 十 | 高 |
| LLM04 | 数据与模型投毒 | 六 / 七 / 十 | 高 |
| LLM05 | 不当输出处理 | 三（输出层） | 高 |
| LLM06 | 过度授权（Excessive Agency） | 八 | 严重 |
| LLM07 | System Prompt 泄露 | 五 | 中-高 |
| LLM08 | 向量与嵌入弱点（RAG/向量库） | 六 | 高 |
| LLM09 | 错误信息（幻觉/虚假信息） | 十二 | 中 |
| LLM10 | 无界消耗（资源 DoS） | 十二 | 中 |
三、提示词注入（Prompt Injection）—— LLM01
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 681 lines · 150 tokens per session scan F 10f2989442cd
ai-llm-agent-security is a skill published in the GitHub repository zhaji2333/CkSKILLS (81 stars, last pushed 11d ago), licensed MIT. It adds 150 tokens to every session and 10,110 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
gpt-image-2
A skill for generating or editing images with GPT Image 2 across local, host-provided, or advisory setups.
kb-retriever
A retrieval and question-answering assistant for a local folder of documents, including Markdown, text, PDFs, and spreadsheets.
iflytek-image-understanding
An image-analysis tool that describes pictures and answers questions about what they contain. It uses an AI vision service, which interprets visual content rather than only reading text files.
ollama-optimizer
Optimize Ollama configuration for the current machine's hardware. Use when asked to speed up Ollama, tune local LLM performance, or pick models that fit available GPU/RAM. Don't use for LM Studio, llama.cpp, vLLM, or hosted-API LLM providers.
LLM
Implement large language model (LLM) chat completions using the z-ai-web-dev-sdk. Use this skill when the user needs to build conversational AI applications, chatbots, AI assistants, or any text generation features. Supports multi-turn conversations, system prompts, and context management.
ASR
Implement speech-to-text (ASR/automatic speech recognition) capabilities using the z-ai-web-dev-sdk. Use this skill when the user needs to transcribe audio files, convert speech to text, build voice input features, or process audio recordings. Supports base64 encoded audio files and returns accurate text…