# Llm Prompt Injection Indirect

> >

- **Type:** Skill
- **Install:** `agentstack add skill-ak-cybe-awesome-offensive-security-skills-llm-prompt-injection-indirect`
- **Verified:** Pending review
- **Seller:** [Ak-cybe](https://agentstack.voostack.com/s/ak-cybe)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [Ak-cybe](https://github.com/Ak-cybe)
- **Source:** https://github.com/Ak-cybe/awesome-offensive-security-skills/tree/main/skills/ai-red-teaming/model-exploitation/llm-prompt-injection-indirect
- **Website:** https://ak-cybe.github.io/cybersecurity-agent-skill

## Install

```sh
agentstack add skill-ak-cybe-awesome-offensive-security-skills-llm-prompt-injection-indirect
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Indirect Prompt Injection (LLM)

## When to Use
- When assessing an LLM application that consumes external, untrusted content (e.g., an AI assistant that summarizes web pages, reads user emails, or processes uploaded resumes).
- To demonstrate how an attacker can compromise a user interacting cleanly with an AI, by leaving a "trap" in data the AI later reads.

## Prerequisites
- Access to target AI/ML system or local model deployment for testing
- Python 3.9+ with relevant ML libraries (transformers, torch, openai)
- Understanding of LLM architecture and prompt processing pipelines
- Authorized scope and rules of engagement for AI red team testing

## Workflow

### Phase 1: Identify External Data Sources

Determine what external data the LLM ingests. Does the chatbot have a "browse the web" feature?
- Is it an email summarization tool?
- Does it parse PDFs or Markdown files uploaded by users?

### Phase 2: Crafting the Concealed Payload

The injection must be placed in the external content in a way that the LLM reads it, but a human might not notice it (or simply ignoring human visibility if it's a raw data feed).

```html
# 

Welcome to my Personal Blog
Here are my thoughts on AI...

 B{What does the AI read? ]}
    B -->|Web Pages| C[Host Malicious HTML ]
    B -->|Documents/PDFs| D[Embed Malicious Text in Doc ]
    C & D --> E[Victim AI Processes Data ]
    E --> F[AI Executes Injection ]
```

## 🔵 Blue Team Detection & Defense
- **Data Source Isolation**: **Output Encoding/Sanitization**: **Context Boundaries (Delimiters)**: Key Concepts
| Concept | Description |
|---------|-------------|
## Output Format
```
Llm Prompt Injection Indirect — Assessment Report
============================================================
Target: [Target identifier]
Assessor: [Operator name]
Date: [Assessment date]
Scope: [Authorized scope]
MITRE ATT&CK: [Relevant technique IDs]

Findings Summary:
  [Finding 1]: [Severity] — [Brief description]
  [Finding 2]: [Severity] — [Brief description]

Detailed Results:
  Phase 1: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

  Phase 2: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

Risk Rating: [Critical/High/Medium/Low/Informational]
Recommendations:
  1. [Immediate remediation step]
  2. [Long-term hardening measure]
  3. [Monitoring/detection improvement]
```

## 📚 Shared Resources
> For cross-cutting methodology applicable to all vulnerability classes, see:
> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns
> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference
> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class

## References
- Embrace the Red: [Indirect Prompt Injection](https://embracethered.com/blog/posts/2023/indirect-prompt-injection/)
- OWASP Top 10 for LLMs: [LLM01: Prompt Injection](https://owasp.org/www-project-top-10-for-large-language-model-applications/)

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Ak-cybe](https://github.com/Ak-cybe)
- **Source:** [Ak-cybe/awesome-offensive-security-skills](https://github.com/Ak-cybe/awesome-offensive-security-skills)
- **License:** Apache-2.0
- **Homepage:** https://ak-cybe.github.io/cybersecurity-agent-skill

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: flagged — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-ak-cybe-awesome-offensive-security-skills-llm-prompt-injection-indirect
- Seller: https://agentstack.voostack.com/s/ak-cybe
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.