CC breach
Designing red team attack scenarios, threat models, MITRE ATT&CK/OWASP application, Purple Team exercises, and AI/LLM red teaming. Use when adversarial security validation is needed.
Designing red team attack scenarios, threat models, MITRE ATT&CK/OWASP application, Purple Team exercises, and AI/LLM red teaming.
As a process C 56/100 · Has gaps — weak spots: when it triggers, inputs and preconditions, failures and branches
What is at stake
Medium-severity findings: the skill is probably honest, but read what alarmed the scanner.
Instruction override medium severity
Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.
If you install
The text contains phrases like "ignore previous instructions" or "you are now…". That is an attempt to hijack the agent: it may break your rules, the system limits or company policy.
For the author
An honest skill does not need them: state the role and the rules directly without overriding other instructions. Otherwise catalog scanners and corporate filters will block the listing.
How to improve
- The SKILL.md body is over 5,000 tokens: move reference detail into references/ and load it when needed.
For the model run — optional
- Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
- A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.
Guard findings · 29
✓ No critical or high findings
Medium and low: 29
-
medium Instruction override
en-fake-system-promptreference/ai-red-teaming.md:84Fake system prompt injected into content (documentation of a security skill)Category: System Prompt Override
security skill -
low Risky intent
intent-offensive-securityreference/ai-red-teaming.md:1Offensive-security / dual-use content (legitimate for authorised testing; review intended use)# AI/LLM Red Teaming Reference
-
low Risky intent
intent-offensive-securityreference/ai-red-teaming.md:4Offensive-security / dual-use content (legitimate for authorised testing; review intended use)**Read when:** Red teaming AI-powered systems including LLMs, RAG, and agentic applications.
-
low Risky intent
intent-offensive-securityreference/ai-red-teaming.md:25Offensive-security / dual-use content (legitimate for authorised testing; review intended use)| LLM06 | **Excessive Agency** | Abuse over-permissioned tool access | Privilege escalation via tools, unintended action execution |
-
low Risky intent
intent-offensive-securityreference/ai-red-teaming.md:119Offensive-security / dual-use content (legitimate for authorised testing; review intended use)## AI Red Team Assessment Template
-
low Risky intent
intent-offensive-securityreference/ai-red-teaming.md:122Offensive-security / dual-use content (legitimate for authorised testing; review intended use)## AI Red Team Assessment: [System Name]
-
low Risky intent
intent-offensive-securityreference/attack-playbooks.md:13Offensive-security / dual-use content (legitimate for authorised testing; review intended use)| A01 | Broken Access Control | IDOR, forced browsing, privilege escalation, JWT manipulation | Enumerate resources with different auth levels; test horizontal/vertical access |
-
low Risky intent
intent-offensive-securityreference/attack-playbooks.md:52Offensive-security / dual-use content (legitimate for authorised testing; review intended use)| Privilege Escalation | T1068 Exploitation, T1548 Abuse Elevation Control | Kernel exploits, sudo misconfig |
-
low Risky intent
intent-offensive-securityreference/attack-playbooks.md:54Offensive-security / dual-use content (legitimate for authorised testing; review intended use)| Credential Access | T1110 Brute Force, T1003 OS Credential Dumping | Password spraying, hash extraction |
-
low Risky intent
intent-offensive-securityreference/attack-playbooks.md:55Offensive-security / dual-use content (legitimate for authorised testing; review intended use)| Lateral Movement | T1021 Remote Services, T1080 Taint Shared Content | SSH pivoting, shared drive abuse |
-
low Risky intent
intent-offensive-securityreference/attack-playbooks.md:94Offensive-security / dual-use content (legitimate for authorised testing; review intended use)### Red Team Actions
-
low Risky intent
intent-offensive-securityreference/phishing-campaign-design.md:1Offensive-security / dual-use content (legitimate for authorised testing; review intended use)# Phishing Campaign Design Reference
-
low Risky intent
intent-offensive-securityreference/phishing-campaign-design.md:3Offensive-security / dual-use content (legitimate for authorised testing; review intended use)Purpose: Design an authorized phishing campaign that measures real organizational susceptibility, exercises the detection and reporting loop, and produces awareness-training input — without exposing p
-
low Risky intent
intent-offensive-securityreference/phishing-campaign-design.md:9Offensive-security / dual-use content (legitimate for authorised testing; review intended use)- **Probe (elsewhere)**: DAST / penetration testing of the landing-page infrastructure itself. Not the social pretext.
-
low Risky intent
intent-offensive-securityreference/recipes-index.md:14Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (documentation table row)| Attack Scenario | `scenario` | ✓ | Attack scenario and kill-chain design — signals `attack scenario` / `kill chain` / `pentest plan` / `WAF bypass` / `control validation` | `reference/attack-playboo
table -
low Risky intent
intent-offensive-securityreference/recipes-index.md:17Offensive-security / dual-use content (legitimate for authorised testing; review intended use)| AI/LLM Red Team | `ai-red` | | AI/LLM red team — signals `prompt injection` / `jailbreak` / `agentic risk` / `RAG poisoning` / `prompt leakage` / `MAESTRO` / `agent skill` / `tool registry`. Multi-t
-
low Risky intent
intent-offensive-securityreference/recipes-index.md:18Offensive-security / dual-use content (legitimate for authorised testing; review intended use)| Phishing Campaign | `phishing` | | Authorized campaign design — pretexting, landing-page clones, MFA fatigue, quishing, OAuth consent phishing, SPF/DKIM/DMARC evasion, awareness-training integration
-
low Risky intent
intent-offensive-securityreference/supply-chain-attack-design.md:63Offensive-security / dual-use content (legitimate for authorised testing; review intended use)Mitigation guidance the red team should expect to validate:
-
low Risky intent
intent-offensive-securityreference/threat-modeling.md:142Offensive-security / dual-use content (legitimate for authorised testing; review intended use)| Privilege Escalation | T1068 | Exploitation for Privilege Escalation | [H/M/L] | [H/M/L] |
-
low Risky intent
intent-offensive-securityreference/threat-modeling.md:145Offensive-security / dual-use content (legitimate for authorised testing; review intended use)| Lateral Movement | T1021 | Remote Services | [H/M/L] | [H/M/L] |
-
low Risky intent
intent-offensive-securityreference/threat-modeling.md:198Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)- question: "What is the scope of this red team assessment?"
quoted -
low Risky intent
intent-offensive-securitySKILL.md:3Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)description: "Designing red team attack scenarios, threat models, MITRE ATT&CK/OWASP application, Purple Team exercises, and AI/LLM red teaming. Use when adversarial security validation is needed."
quoted -
low Risky intent
intent-offensive-securitySKILL.md:19Offensive-security / dual-use content (legitimate for authorised testing; review intended use)- Probe → Breach: DAST vulnerabilities feed into exploitation chain design
-
low Risky intent
intent-offensive-securitySKILL.md:21Offensive-security / dual-use content (legitimate for authorised testing; review intended use)- Oracle → Breach: AI/ML architecture provides attack surface for AI red teaming
-
low Risky intent
intent-offensive-securitySKILL.md:39Offensive-security / dual-use content (legitimate for authorised testing; review intended use)Red team engineering agent that thinks like an attacker. Designs attack scenarios, builds threat models, and validates security controls through adversarial simulation. Covers traditional application
-
low Risky intent
intent-offensive-securitySKILL.md:52Offensive-security / dual-use content (legitimate for authorised testing; review intended use)- AI/LLM red teaming (prompt injection, jailbreak, agentic risks)
A further 3 matches are quotations in this security skill's documentation and are not counted as findings.
Files scanned: 10. Evidence is masked. Grey chips explain why severity was lowered.
Against the Agent Skills spec
- warning
body-longSKILL.md body ≈ 5721 tokens (recommended < 5000); move details to references/
Process rating: all ten parameters 56/100
- 0Inputs and preconditions. Does not say what the process needs to start
- 0Failures and branches. Linear process with no failure handling
- 0Progress reporting. Says nothing while it works
- 20When it triggers. No condition that starts the skill
- 30Running it twice. 15 mutating operations with no state check
- 60Tools and files. Uses tools (bash) that frontmatter does not declare
- 70Execution cost. Instruction body is 5721 tokens
- 100Steps. 106 steps
- 100Result and completion. Output format and completion criterion are stated
- 100Consistency. Name and required fields are in place
- low 16 top-level sections: this looks like several domains in one skill
Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.
Quality signals
- +5Description has no quoted example phrases that should trigger the skill
- +4Description does not say when NOT to use the skill (false activations)
- +1No license
- +2Single-language instructions
- +3Description length 182: enough signal without eating the budget
- +4Structure: 22 headings
- +3Step-by-step instructions: 106 items
- +3Output format is stated explicitly
- +4Has examples (2 code blocks)
- +4Reference files are cited in the instructions (9 of 9)
Quality base 70; lint remarks subtract, signals add up to 100. Result: 81.