Llm Prompt Injection Indirect

Indirect Prompt Injection (LLM)

When to Use

• When assessing an LLM application that consumes external, untrusted content (e.g., an AI assistant that summarizes web pages, reads user emails, or processes uploaded resumes).
• To demonstrate how an attacker can compromise a user interacting cleanly with an AI, by leaving a "trap" in data the AI later reads.

Prerequisites

• Access to target AI/ML system or local model deployment for testing
• Python 3.9+ with relevant ML libraries (transformers, torch, openai)
• Understanding of LLM architecture and prompt processing pipelines
• Authorized scope and rules of engagement for AI red team testing

Workflow

Phase 1: Identify External Data Sources

Determine what external data the LLM ingests. Does the chatbot have a "browse the web" feature?

• Is it an email summarization tool?
• Does it parse PDFs or Markdown files uploaded by users?

Phase 2: Crafting the Concealed Payload

The injection must be placed in the external content in a way that the LLM reads it, but a human might not notice it (or simply ignoring human visibility if it's a raw data feed).

# 

Welcome to my Personal Blog
Here are my thoughts on AI...

 B{What does the AI read? ]}
    B -->|Web Pages| C[Host Malicious HTML ]
    B -->|Documents/PDFs| D[Embed Malicious Text in Doc ]
    C & D --> E[Victim AI Processes Data ]
    E --> F[AI Executes Injection ]

🔵 Blue Team Detection & Defense

• Data Source Isolation: Output Encoding/Sanitization: Context Boundaries (Delimiters): Key Concepts

| Concept | Description | |---------|-------------|

Output Format

Llm Prompt Injection Indirect — Assessment Report
============================================================
Target: [Target identifier]
Assessor: [Operator name]
Date: [Assessment date]
Scope: [Authorized scope]
MITRE ATT&CK: [Relevant technique IDs]

Findings Summary:
  [Finding 1]: [Severity] — [Brief description]
  [Finding 2]: [Severity] — [Brief description]

Detailed Results:
  Phase 1: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

  Phase 2: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

Risk Rating: [Critical/High/Medium/Low/Informational]
Recommendations:
  1. [Immediate remediation step]
  2. [Long-term hardening measure]
  3. [Monitoring/detection improvement]

📚 Shared Resources

> For cross-cutting methodology applicable to all vulnerability classes, see: > - [_shared/references/elite-chaining-strategy.md](../shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns > - [_shared/references/elite-report-writing.md](../shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference > - [_shared/references/real-world-bounties.md](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class

References

• Embrace the Red: Indirect Prompt Injection
• OWASP Top 10 for LLMs: LLM01: Prompt Injection

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Ak-cybe
• Source: Ak-cybe/awesome-offensive-security-skills
• License: Apache-2.0
• Homepage: https://ak-cybe.github.io/cybersecurity-agent-skill

Install and usage instructions live in the source repository linked above.