# LLM Prompt Injection Indirect > Exploit AI applications using Indirect Prompt Injection. This skill focuses on hiding malicious instructions within data sources (web pages, documents, emails) that the LLM processes, causing the AI to execute unintended actions or leak data without direct user interaction. - Skill: `shulkwisec/llm-prompt-injection-indirect` (Agent Skill, multi-file: 3 files) - Install (CLI): `npx skillmds add shulkwisec/llm-prompt-injection-indirect` - Raw SKILL.md: https://api.skillmd.com/api/skills/shulkwisec/llm-prompt-injection-indirect/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: AI & ML - License: Apache-2.0 - Author: ShulkwiSEC (https://skillmd.com/u/shulkwisec) - Updated: 2026-09-08 - Page: https://skillmd.com/skills/shulkwisec/llm-prompt-injection-indirect --- # Indirect Prompt Injection (LLM) ## When to Use - When assessing an LLM application that consumes external, untrusted content (e.g., an AI assistant that summarizes web pages, reads user emails, or processes uploaded resumes). - To demonstrate how an attacker can compromise a user interacting cleanly with an AI, by leaving a "trap" in data the AI later reads. ## Prerequisites - Access to target AI/ML system or local model deployment for testing - Python 3.9+ with relevant ML libraries (transformers, torch, openai) - Understanding of LLM architecture and prompt processing pipelines - Authorized scope and rules of engagement for AI red team testing ## Workflow ### Phase 1: Identify External Data Sources Determine what external data the LLM ingests. Does the chatbot have a "browse the web" feature? - Is it an email summarization tool? - Does it parse PDFs or Markdown files uploaded by users? ### Phase 2: Crafting the Concealed Payload The injection must be placed in the external content in a way that the LLM reads it, but a human might not notice it (or simply ignoring human visibility if it's a raw data feed). ```html #

Welcome to my Personal Blog

Here are my thoughts on AI...

B{What does the AI read? ]} B -->|Web Pages| C[Host Malicious HTML ] B -->|Documents/PDFs| D[Embed Malicious Text in Doc ] C & D --> E[Victim AI Processes Data ] E --> F[AI Executes Injection ] ``` ## 🔵 Blue Team Detection & Defense - **Data Source Isolation**: **Output Encoding/Sanitization**: **Context Boundaries (Delimiters)**: Key Concepts | Concept | Description | |---------|-------------| ## Output Format ``` Llm Prompt Injection Indirect — Assessment Report ============================================================ Target: [Target identifier] Assessor: [Operator name] Date: [Assessment date] Scope: [Authorized scope] MITRE ATT&CK: [Relevant technique IDs] Findings Summary: [Finding 1]: [Severity] — [Brief description] [Finding 2]: [Severity] — [Brief description] Detailed Results: Phase 1: [Phase name] - Result: [Outcome] - Evidence: [Screenshot/log reference] - Impact: [Business impact assessment] Phase 2: [Phase name] - Result: [Outcome] - Evidence: [Screenshot/log reference] - Impact: [Business impact assessment] Risk Rating: [Critical/High/Medium/Low/Informational] Recommendations: 1. [Immediate remediation step] 2. [Long-term hardening measure] 3. [Monitoring/detection improvement] ``` ## 📚 Shared Resources > For cross-cutting methodology applicable to all vulnerability classes, see: > - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns > - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference > - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class ## References - Embrace the Red: [Indirect Prompt Injection](https://embracethered.com/blog/posts/2023/indirect-prompt-injection/) - OWASP Top 10 for LLMs: [LLM01: Prompt Injection](https://owasp.org/www-project-top-10-for-large-language-model-applications/)