/llm-redteam
LLM red-team corpus runner — fires categorized prompt-injection / jailbreak / system-prompt-leak / data-exfil / indirect-injection / guardrail-bypass payloads at a chat endpoint and canary-detects which land. Usage: /llm-redteam --url <chat-endpoint> --field message [--category
$ npx -y skills add shuvonsec/claude-bug-bounty --agent claude-codeHow it fires
How this command gets triggered: by you, by Claude, or both.
- Fires itselfClaude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/llm-redteam
Context preview
What this command does when you run it.
LLM red-team corpus runner — fires categorized prompt-injection / jailbreak / system-prompt-leak / data-exfil / indirect-injection / guardrail-bypass payloads at a chat endpoint and canary-detects which land. Usage: /llm-redteam --url <chat-endpoint> --field message [--category
Command definition
llm-redteam.mddescription: LLM red-team corpus runner — fires categorized prompt-injection / jailbreak / system-prompt-leak / data-exfil / indirect-injection / guardrail-bypass payloads at a chat endpoint and canary-detects which land. Usage: /llm-redteam --url <chat-endpoint> --field message [--category jailbreak]
/llm-redteam
Automated LLM/agentic red-teaming. Instead of hand-firing one prompt-injection at a time, this runs a categorized corpus against a chat endpoint and uses a **canary token** to reliably detect which payloads succeeded.
Usage
# simple endpoint that takes {"message": "..."}
/llm-redteam --url https://t/api/chat --field message
# only one category
/llm-redteam --url https://t/api/chat --field message --category jailbreak
# OpenAI-style body + nested response path
/llm-redteam --url https://t/api/chat \
--template '{"messages":[{"role":"user","content":"{{PAYLOAD}}"}]}' \
--response-path choices.0.message.contentRun directly:
tools/llm_redteam.py --url https://t/api/chat --field message --json
tools/llm_redteam.py --list-categories
Categories (OWASP LLM Top 10 / ASI)
| Category | Tests | OWASP | |---|---|---| | `prompt-injection` | direct instruction override | LLM01 | | `jailbreak` | DAN / developer-mode persona escape | LLM01 | | `system-prompt-leak` | extract the hidden system prompt | LLM07 | | `data-exfil` | markdown-image beacon to attacker host | LLM02/LLM06 | | `indirect-injection` | payload framed as a retrieved document | LLM01 (indirect) | | `guardrail-bypass` | base64 / split-instruction filter evasion | LLM01 |
How detection works
Most payloads instruct the model to emit a unique token (`RT_PWNED_xxxx`). If that token appears in the response, the injection landed — far more reliable than keyword matching. System-prompt-leak uses a multi-signal heuristic; `data-exfil` confirms when the canary URL is reflected in the output.
`--header "Authorization: Bearer ..."` (repeatable) for authed chatbots.
Turn a hit into a report
A bare prompt-injection is **Informational** until chained. Escalate: injection → **chatbot IDOR** (read another user's data), **data exfil** (the markdown-beacon hit proves a working channel), or **RCE** if the agent has a code/tool execution capability. See `skills/web2-vuln-classes` §11 and `skills/bug-bounty` Agentic AI (ASI01–ASI10).
Read more
description: LLM red-team corpus runner — fires categorized prompt-injection / jailbreak / system-prompt-leak / data-exfil / indirect-injection / guardrail-bypass payloads at a chat endpoint and canary-detects which land. Usage: /llm-redteam --url <chat-endpoint> --field message [--category jailbreak]
/llm-redteam
Automated LLM/agentic red-teaming. Instead of hand-firing one prompt-injection at a time, this runs a categorized corpus against a chat endpoint and uses a **canary token** to reliably detect which payloads succeeded.
Usage
# simple endpoint that takes {"message": "..."}
/llm-redteam --url https://t/api/chat --field message
# only one category
/llm-redteam --url https://t/api/chat --field message --category jailbreak
# OpenAI-style body + nested response path
/llm-redteam --url https://t/api/chat \
--template '{"messages":[{"role":"user","content":"{{PAYLOAD}}"}]}' \
--response-path choices.0.message.contentRun directly:
tools/llm_redteam.py --url https://t/api/chat --field message --json tools/llm_redteam.py --list-categories
Categories (OWASP LLM Top 10 / ASI)
| Category | Tests | OWASP | |---|---|---| | `prompt-injection` | direct instruction override | LLM01 | | `jailbreak` | DAN / developer-mode persona escape | LLM01 | | `system-prompt-leak` | extract the hidden system prompt | LLM07 | | `data-exfil` | markdown-image beacon to attacker host | LLM02/LLM06 | | `indirect-injection` | payload framed as a retrieved document | LLM01 (indirect) | | `guardrail-bypass` | base64 / split-instruction filter evasion | LLM01 |
How detection works
Most payloads instruct the model to emit a unique token (`RT_PWNED_xxxx`). If that token appears in the response, the injection landed — far more reliable than keyword matching. System-prompt-leak uses a multi-signal heuristic; `data-exfil` confirms when the canary URL is reflected in the output.
`--header "Authorization: Bearer ..."` (repeatable) for authed chatbots.
Turn a hit into a report
A bare prompt-injection is **Informational** until chained. Escalate: injection → **chatbot IDOR** (read another user's data), **data exfil** (the markdown-beacon hit proves a working channel), or **RCE** if the agent has a code/tool execution capability. See `skills/web2-vuln-classes` §11 and `skills/bug-bounty` Agentic AI (ASI01–ASI10).
AI-powered bug bounty hunting from your terminal - recon, 20 vuln classes, autonomous hunting, and report generation. All inside Claude Code.
Repo: shuvonsec/claude-bug-bounty
Other commands on claude-bug-bounty.
- /arsenal
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from high-signal repos. Use to bootstrap a fresh box or audit which optional capabilities are wired in. Usage: /arsenal | /arsenal <tool-name>
Open command - /autopilot
Run autonomous hunt loop on a target — scope check → recon → rank surface → hunt → validate → report with configurable checkpoints. Usage: /autopilot target.com [--paranoid|--normal|--yolo]
Open command - /breach-check
HIBP k-anonymity check on a password wordlist. Enriches each password with its breach count, ranks DESC. Free API (no key), only first 5 chars of SHA-1 sent. Output -> <input>-ranked.txt. Usage /breach-check <wordlist> [--min-count N] [--max-count N] [--with-counts]
Open command - /bypass-403
Probe a 403/401 endpoint with the most-paid bypass tricks (header injection, path encoding, method swap, WAF fingerprint, vendor-specific). Wraps byp4xx when installed; otherwise runs a built-in matrix of 38+ techniques. Usage: /bypass-403 <url> | /bypass-403 -l <urls-file>
Open command - /chain
Build an exploit chain — given bug A, finds B and C to combine for higher severity and payout. Knows common chain patterns: IDOR→ATO, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth. Usage: /chain
Open command - /cloud-recon
Sweep cloud assets for a target — public S3/Azure/GCP buckets via S3Scanner and cloud_enum, plus CloudFlare-bypassed origin IPs via CloudFail (or built-in DNS-history fallback). Use --keyword for storage discovery and --cf-bypass to find an origin IP behind CloudFlare. Usage:
Open command