Is the AI Agent Redteam skill free?

Yes. The skill itself is free from hypnguyen1209/offensive-claude. SkillProof publishes the install command and an independent test verdict at no cost.

What is the AI Agent Redteam SkillProof Score?

9.2/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 8/10, docs & honesty 5/5.

How do I install AI Agent Redteam?

Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.

Can I use AI Agent Redteam with Cursor, Copilot, Gemini CLI, Codex or other AI tools?

The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.

AI Agent Redteam

Red-team LLM agents: prompt injection, MCP poisoning, memory poisoning, multi-turn jailbreaks

by hypnguyen1209 · hypnguyen1209/offensive-claude

Tested · Works

Install — copy the command Download source ↗

Test report

Verdict: Tested · Works
Score: 9.2/10
Tested: Jul 31, 2026
Environment: Claude Code 2.x (agent harness)
Upstream re-checked: Aug 10, 2026 · 84d59c6

Cloned into a temp HOME and ran scripts/indirect_injection_forge.py; it produced a valid multipart/alternative .eml (/tmp/skill_payload.eml, 1172 bytes) with the injection hidden in an HTML comment, a reference-style markdown image exfil beacon, and a unique per-run token (ae7c3522aac8). Baseline I hand-wrote for the same task (328 bytes) used the naive "Ignore previous instructions" string and a plaintext attacker URL; the skill output instead phrases the instruction at the human (no "ignore"/"AI"), builds proper MIME plain+html parts, uses EchoLeak redaction-bypass reference-markdown exfil, and adds base64(collected_data) DLP evasion — all verified by grep diff. Spot-checked 3 referenced files (2 scripts, 1 reference) all HTTP 200; harness and multiturn --help parse. Security scan: dual-use offensive tooling but openly labeled, no curl|sh, no hardcoded exfil host, no covert secret theft — all network targets are user-supplied --endpoint args. Live-endpoint harness/jailbreak/fuzzer scripts need external LLM endpoints + pyrit/garak/promptfoo I did not run.

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

Installs cleanly 5/5
Triggers reliably 5/5
Output vs. baseline 8/10
Docs & honesty 5/5

What AI Agent Redteam does

Offensive red-teaming skill for autonomous LLM agents: forges indirect/zero-click prompt-injection payloads, poisoned MCP servers, persistent-memory injections, excessive-agency tool fuzzing, and automated multi-turn jailbreak campaigns with ASR scoring, mapped to OWASP Agentic Top 10 and MITRE ATLAS. Triggers when the user is running an authorized pentest of an agentic AI application with tool-calling, MCP clients, RAG, or persistent memory. Ships six runnable Python scripts (stdlib for payload forging; requests/subprocess for live-endpoint harnesses).

How to install AI Agent Redteam

git clone --depth 1 https://github.com/hypnguyen1209/offensive-claude.git /tmp/ai-agent-redteam-src
mkdir -p ~/.claude/skills
cp -R /tmp/ai-agent-redteam-src/skills/ai-agent-redteam ~/.claude/skills/ai-agent-redteam
# Payload-forging scripts (indirect_injection_forge.py) are Python stdlib-only, run as-is.
# Live-endpoint scripts need: pip install requests pillow  (pillow only for --channel image)
# Harness run/score modes shell out to external tools you must install separately: pyrit, garak, promptfoo
# multiturn_jailbreak.py / agency_tool_fuzzer.py / memory_poison_minja.py require live OpenAI-compatible
#   --target-endpoint (and optional --judge-endpoint) + API keys — not exercised in this test.
# Plugin-marketplace alt: repo ships .claude-plugin/marketplace.json for `/plugin marketplace add`.
# AUTHORIZED ENGAGEMENTS ONLY — repo includes TERMS.md and SECURITY.md.

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger AI Agent Redteam

/ai-agent-redteam Red-team LLM agents: prompt injection, MCP poisoning, memory poisoning, multi-turn jailbreaks

It also activates on plain-language prompts like these:

Red-team this agent for prompt injection risks
Test this MCP tool for poisoning vulnerabilities
Run a multi-turn jailbreak test against this agent

Frequently asked questions

Is the AI Agent Redteam skill free?: Yes. The skill itself is free from hypnguyen1209/offensive-claude. SkillProof publishes the install command and an independent test verdict at no cost.
Does AI Agent Redteam work with Claude Code?: We tested it with Claude Code 2.x (agent harness) on Jul 31, 2026. Verdict: Tested · Works. Cloned into a temp HOME and ran scripts/indirect_injection_forge.py; it produced a valid multipart/alternative .eml (/tmp/skill_payload.eml, 1172 bytes) with the injection hidden in an HTML comment, a reference-style markdown image exfil beacon, and a unique per-run token (ae7c3522aac8). Baseline I hand-wrote for the same task (328 bytes) used the naive "Ignore previous instructions" string and a plaintext attacker URL; the skill output instead phrases the instruction at the human (no "ignore"/"AI"), builds proper MIME plain+html parts, uses EchoLeak redaction-bypass reference-markdown exfil, and adds base64(collected_data) DLP evasion — all verified by grep diff. Spot-checked 3 referenced files (2 scripts, 1 reference) all HTTP 200; harness and multiturn --help parse. Security scan: dual-use offensive tooling but openly labeled, no curl|sh, no hardcoded exfil host, no covert secret theft — all network targets are user-supplied --endpoint args. Live-endpoint harness/jailbreak/fuzzer scripts need external LLM endpoints + pyrit/garak/promptfoo I did not run.
What is the AI Agent Redteam SkillProof Score?: 9.2/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 8/10, docs & honesty 5/5.
How do I install AI Agent Redteam?: Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use AI Agent Redteam with Cursor, Copilot, Gemini CLI, Codex or other AI tools?: The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.