Borrowing it
Nothing to install: this file belongs to zhaji2333/CkSKILLS. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/zhaji2333/CkSKILLS/main/.agents/skills/ai-llm-agent-security/SKILL.mdgit clone --depth 1 https://github.com/zhaji2333/CkSKILLSWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zhaji2333/ckskills/ai-llm-agent-security)<a href="https://agentmods.dev/skills/zhaji2333/ckskills/ai-llm-agent-security"><img src="https://agentmods.dev/badge/skills/zhaji2333/ckskills/ai-llm-agent-security/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zhaji2333/ckskills/ai-llm-agent-security"><img src="https://agentmods.dev/badge/skills/zhaji2333/ckskills/ai-llm-agent-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00150 | $0.10110 |
| Opus 5.5 | $0.00060 | $0.04044 |
| Sonnet 5.5 | $0.00030 | $0.02022 |
| Haiku 4.5 | $0.00015 | $0.01011 |
Grade A, and why
ai-llm-agent-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 681 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ai-llm-agent-security — AI / LLM / Agent 安全专项深度挖掘
本技能以 OWASP LLM Top 10 (2025) 为骨架，结合实战打法，覆盖从提示词层到 Agent 工具层、从数据层到模型供应链层的完整攻击面。
何时调用（触发条件）
- 目标含 LLM 后端：Chatbot、智能客服、AI 助手、Copilot、AI 写作/编程/搜索/问答
- 用户输入进入大模型提示词（直接对话、模板填充、系统消息拼接）
- 用户输入进入 Agent 工具调用（function calling、代码解释器、shell 执行、浏览器、文件读写、SQL 执行、API 调用）
- 系统含 RAG 知识库（向量检索、文档问答、Embedding、向量库 Milvus/Pinecone/Chroma/pgvector）
- 系统含 对话记忆（多轮上下文、长期记忆、跨会话持久化、用户画像）
- 系统含 文件/URL 解析喂入 LLM（PDF/Word/网页/邮件/图片 OCR）
- 目标暴露模型服务（OpenAI 兼容 API、HuggingFace 推理、vLLM/Ollama 本地部署）
- 出现 LLM 输出回显前端、LLM 输出进入下游执行（渲染/存储/SQL/命令）
- 需要测试 越狱（Jailbreak）/护栏绕过/System Prompt 泄露/敏感信息泄露
- 需要测试 RAG 投毒 / Agent 记忆污染 / 工具滥用 / 沙箱逃逸
一、攻击面与信任边界建模（先建模再动手）
┌─────────────────────────────────────────────────────────────┐
│ 攻击面分层（自上而下，越下层危害越大） │
├─────────────────────────────────────────────────────────────┤
│ L1 提示词层 : 用户输入 → System Prompt / 对话上下文 │
│ L2 模型层 : 训练数据泄露 / 幻觉 / 不当输出 │
│ L3 输出层 : LLM 输出 → 前端渲染 / 下游执行（XSS/SQL/RCE） │
│ L4 检索层 : RAG 知识库 / 向量库 / Embedding │
│ L5 记忆层 : 短期上下文 / 长期记忆 / 用户画像 / 跨会话 │
│ L6 工具层 : Function Calling / 代码解释器 / Shell / 浏览器 │
│ L7 沙箱层 : 代码沙箱 / 工具执行环境 / Agent 运行时 │
│ L8 供应链层 : 模型权重 / 插件 / 依赖库 / 第三方模型 API │
└─────────────────────────────────────────────────────────────┘
五问建模：
- 用户输入经过几道处理进入 LLM？是否可被截断/拼接/覆盖？
- LLM 能调用哪些工具？哪些有副作用（写文件/执行命令/发请求/改数据库）？
- 知识库数据来源是否可信？用户能否写入知识库内容？
- 对话记忆是否跨会话持久化？历史消息能否被污染？
- LLM 输出流向哪里？前端渲染？下游执行？是否做净化？
二、OWASP LLM Top 10 (2025) 全景速查
| 编号 | 风险 | 本技能章节 | 危害等级 |
|---|---|---|---|
| LLM01 | 提示词注入（Prompt Injection） | 三 | 严重 |
| LLM02 | 敏感信息泄露 | 五 | 严重 |
| LLM03 | 供应链 | 十 | 高 |
| LLM04 | 数据与模型投毒 | 六 / 七 / 十 | 高 |
| LLM05 | 不当输出处理 | 三（输出层） | 高 |
| LLM06 | 过度授权（Excessive Agency） | 八 | 严重 |
| LLM07 | System Prompt 泄露 | 五 | 中-高 |
| LLM08 | 向量与嵌入弱点（RAG/向量库） | 六 | 高 |
| LLM09 | 错误信息（幻觉/虚假信息） | 十二 | 中 |
| LLM10 | 无界消耗（资源 DoS） | 十二 | 中 |
三、提示词注入（Prompt Injection）—— LLM01
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 681 lines · 150 tokens per session scan F 10f2989442cd
ai-llm-agent-security is a skill published in the GitHub repository zhaji2333/CkSKILLS (126 stars, last pushed 1mo ago), licensed MIT. It adds 150 tokens to every session and 10,110 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
gpt-image-2
A skill for generating or editing images with GPT Image 2 across local, host-provided, or advisory setups.
kb-retriever
A retrieval and question-answering assistant for a local folder of documents, including Markdown, text, PDFs, and spreadsheets.
iflytek-image-understanding
An image-analysis tool that describes pictures and answers questions about what they contain. It uses an AI vision service, which interprets visual content rather than only reading text files.
ollama-optimizer
Optimize Ollama configuration for the current machine's hardware. Use when asked to speed up Ollama, tune local LLM performance, or pick models that fit available GPU/RAM. Don't use for LM Studio, llama.cpp, vLLM, or hosted-API LLM providers.
azure-data-factory
Expert knowledge for Azure Data Factory development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when configuring IR/SSIS/SHIR, mapping data flows, SAP/SaaS connectors, CI/CD…
azure-machine-learning
Expert knowledge for Azure Machine Learning development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when using AutoML, Prompt Flow, online/batch endpoints, vector stores/RAG, or…