testing-agents-for-indirect-prompt-injection SKILL.md skillB
testing-agents-for-indirect-prompt-injection from unboundcompute/security-agent-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add unboundcompute/security-agent-skills/testing-agents-for-indirect-prompt-injection@git:20260816.4aab195Pins git:20260816.4aab195 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- B, 16 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- unboundcompute/security-agent-skills
- Path
skills/testing-agents-for-indirect-prompt-injection/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260816.4aab195, committed Aug 16, 2026
- Size
- 6,889 bytes
- Repository stars
- 26
- License
- MIT
Test whether an AI agent obeys instructions hidden in the content it ingests, rather than only the user's. Enumerate every channel through which untrusted content reaches the model context (retrieved docs, fetched pages, uploaded files, emails, tool outputs, filenames, images and PDFs, other agents), plant channel-appropriate payloads, and measure whether they change the agent's actions. Use when reviewing any agent or LLM app that reads external content and can act. Covers channel…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Testing agents for indirect prompt injection Direct prompt injection is the user attacking the model. *Indirect* prompt injection is a third party planting instructions in content the agent later ingests, so the agent follows an attacker who never touched the prompt. It is the central agent vulnerability because agents exist to read external content and act on it, and models do not reliably separate "data to process" from "instructions to obey" when both share one context. ## When to use - An agent or LLM app ingests any content it did not fully author: web pages, documents, RAG results, emails, tickets, files, tool responses, other agents. - You are reviewing an assistant that can call tools, browse, or send messages. - You need to know if a channel is a data channel or an instruction channel. ## Scope check Test agents and content channels you own or are authorized to test. Use benign, clearly-marked payloads and canaries; never exfiltrate real data or act against systems you do not control. If you can't name the authorization, stop. ## The loop 1. **Enumerate ingestion channels.** List every path by which content the agent …
Read the whole file at its exact version.
How to install
mdr add unboundcompute/security-agent-skills/testing-agents-for-indirect-prompt-injection@sha256:f14ae95f70df41d1The line at the top of this page pins the label git:20260816.4aab195, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_kjjw3eigow6nfysl)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Aug 16, 2026.
Audit of the latest version
- fail: No prompt-injection phrasing (matched: ignore prior instructions)
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (6889 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Starting a new one? Use a template for SKILL.md on mdpantry, which passes every one of these checks and says what to change in it.
Source
unboundcompute/security-agent-skills · 26 stars · license MIT · pushed 2026-09-08 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_kjjw3eigow6nfysl GET https://markdownregistry.com/api/v1/resolve?ref=unboundcompute/security-agent-skills/testing-agents-for-indirect-prompt-injection GET https://markdownregistry.com/api/v1/blob/f14ae95f70df41d14d3c80960b07c1b0c87560f58de45c361d5e113eb08a016b
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.