pwn 0.5.695 → 0.5.696

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 445532063d09a6c2edd54ac2872c295932bdbdc45d025e87fe109a5e8641ce0f
-  data.tar.gz: b8b9aab81ae7c16ffcda16cdea943b85eaf69c93b6de929e2eb9fc288cb8f000
+  metadata.gz: 74bfcd98ff2b783dab4bfc6d97a3f8124e00c395f686c05303002e312d5b9596
+  data.tar.gz: 54d5d1abe1a695c1fb9dd7757becf2648857ff46dd96d9462ee5f73219a13146
 SHA512:
-  metadata.gz: 85071aaac40e5ed6348a52a7858be4dd1b781db8b706324b054a67e254c365bab4d10d4aba182ee42a387e15574b8f6b7fc67d2b31b1559dd17b5d7d6dfccae5
-  data.tar.gz: a677194de81bb47090ba62cebac6f293d68fc4e4876693faae868cfe96434478610fece0478e93eb980af4d688819ea1310cb6048bb7096b27a0bdbe516bf1da
+  metadata.gz: b60265a293cf56ae14e0ff8d3f822faa36ea0b530f6d01c2a9bbd5b2c3256ab3525df45f964a13939c77672c76e4c0b67647baeca3c1faf2f987ff9221a04999
+  data.tar.gz: b600f46b403f45c2418640a9047653759200d4aca46d2d0571992e6ae1d8501f40c1b28fb9515c2d38b9f313932b4441443b57c61c250b0560b7d5466df7bf43

data/documentation/Session-Workflow.md

@@ -15,7 +15,8 @@ operator cheat sheet.
 1. Entering `pwn-ai` always creates a **new** `~/.pwn/sessions/<timestamp>_<hex>.jsonl`.
 2. Cheap intents (greeting, how-to, recall) never open a host-work goal.
 3. Everything else is an autonomous goal. `Loop.run` keeps CORE_TOOLS until
-   the original request is done or truly blocked.
+   the original request is done or a tool returned failure evidence.
+   pwn-ai does not decide authorization.
 4. An unfinished host-work request is written to `~/.pwn/open_goal.json`.
 5. An accepted final answer deletes that file. Budget exhaust leaves it.
 

data/etc/default_skills/pwn/ai/agent/loop/SKILL.md

@@ -12,7 +12,7 @@ metadata:
 
 # PWN::AI::Agent::Loop
 
-The agent conversation loop: build system prompt → call LLM with tools → if tool_calls: dispatch, append role:'tool' results, loop → else: return text. This replaces the regex-ReAct in PWN::Plugins::REPL :pwn_ai_hook with native function-calling. State (memory, skills, sessions) is all externalised — Loop.run is stateless aside from the messages array it builds. NEGATIVE-FEEDBACK CLOSURE ------------------------- Loop.run is where "learn from mistakes, don't repeat them" is actually enforced. On EVERY failed dispatch it: 1. Records the (tool, normalised_error) fingerprint into PWN::AI::Agent::Mistakes with a PERSISTENT cross-session count. 2. Reads that count back and, if it OR the in-turn count reaches REPEAT_THRESHOLD, prepends a hard "REPEATED FAILURE — change approach" guard to the tool result the model sees next. 3. Appends Mistakes.correction_hint (seen N×, sig, KNOWN FIX: …) so a previously-discovered fix is handed straight back to the model on the FIRST recurrence in a new session — it does not have to fail 3× again to re-learn what it already knew. PromptBuilder.mistakes_block re-injects the top open mistakes and top known fixes into the system prompt of every future turn. COMPLETION ---------- The original request is the completion signal. TaskSummarizer and Policy are advisory (compass / rank). Loop keeps calling CORE_TOOLS until that request is done or truly blocked, then stops. LOCAL-MODEL SCAFFOLDING ----------------------- When the active engine is :ollama (or the corresponding :agent flags are set) Loop.run additionally: * threads request → PromptBuilder for relevance-ranked MEMORY, * threads request → Registry.definitions(relevance:) for a slimmed tool set (:tool_router), * splices Learning.exemplars_for(request:) between system and user as few-shot behaviour retrieval, * runs a plan-then-act pre-pass (:plan_first) so the model externalises a tool plan before its first dispatch, * escalates to a frontier persona for a 3-line corrective hint once ≥ ESCALATE_AFTER_FAILS in-turn failures accumulate (:escalation_persona) — the local model still produces the final answer so Learning/Metrics stay attributed to :ollama.
+The agent conversation loop: build system prompt → call LLM with tools → if tool_calls: dispatch, append role:'tool' results, loop → else: return text. This replaces the regex-ReAct in PWN::Plugins::REPL :pwn_ai_hook with native function-calling. State (memory, skills, sessions) is all externalised — Loop.run is stateless aside from the messages array it builds. NEGATIVE-FEEDBACK CLOSURE ------------------------- Loop.run is where "learn from mistakes, don't repeat them" is actually enforced. On EVERY failed dispatch it: 1. Records the (tool, normalised_error) fingerprint into PWN::AI::Agent::Mistakes with a PERSISTENT cross-session count. 2. Reads that count back and, if it OR the in-turn count reaches REPEAT_THRESHOLD, prepends a hard "REPEATED FAILURE — change approach" guard to the tool result the model sees next. 3. Appends Mistakes.correction_hint (seen N×, sig, KNOWN FIX: …) so a previously-discovered fix is handed straight back to the model on the FIRST recurrence in a new session — it does not have to fail 3× again to re-learn what it already knew. PromptBuilder.mistakes_block re-injects the top open mistakes and top known fixes into the system prompt of every future turn. COMPLETION ---------- The original request is the completion signal. TaskSummarizer and Policy are advisory (compass / rank). Loop keeps calling CORE_TOOLS until that request is done or a tool returned failure evidence, then stops. LOCAL-MODEL SCAFFOLDING ----------------------- When the active engine is :ollama (or the corresponding :agent flags are set) Loop.run additionally: * threads request → PromptBuilder for relevance-ranked MEMORY, * threads request → Registry.definitions(relevance:) for a slimmed tool set (:tool_router), * splices Learning.exemplars_for(request:) between system and user as few-shot behaviour retrieval, * runs a plan-then-act pre-pass (:plan_first) so the model externalises a tool plan before its first dispatch, * escalates to a frontier persona for a 3-line corrective hint once ≥ ESCALATE_AFTER_FAILS in-turn failures accumulate (:escalation_persona) — the local model still produces the final answer so Learning/Metrics stay attributed to :ollama.
 
 ## When to use
 

data/etc/default_skills/pwn/ai/red_team/SKILL.md

@@ -12,7 +12,7 @@ metadata:
 
 # PWN::AI::RedTeam
 
-This file, using the autoload directive loads AI RedTeam modules into memory only when they're needed. For more information, see: http://www.rubyinside.com/ruby-techniques-revealed-autoload-1652.html PWN::AI::RedTeam is the AI/LLM analogue of PWN::SAST - a collection of adversarial test-case modules that exhaustively analyze / fuzz Large Language Models for AI-specific vulnerabilities (prompt injection, jailbreaks, system-prompt extraction, sensitive-data disclosure, excessive agency, insecure output handling, etc.). Each module maps to an OWASP LLM Top-10 category and a MITRE ATLAS technique so findings roll straight into PWN::Reports::AIRedTeam.
+This file, using the autoload directive loads AI RedTeam modules into memory only when they're needed. For more information, see: http://www.rubyinside.com/ruby-techniques-revealed-autoload-1652.html PWN::AI::RedTeam is the AI/LLM analogue of PWN::SAST - a collection of adversarial test-case modules that exhaustively analyze / fuzz Large Language Models for AI-specific vulnerabilities (prompt injection, jailbreaks, system-prompt extraction, sensitive-data disclosure, excessive agency, insecure output handling, supply chain, poisoning, unbounded consumption, hidden context, vector stores, RAG, MCP/A2A, and memory persistence). Each module maps to an OWASP LLM Top-10 category and a MITRE ATLAS technique so findings roll straight into PWN::Reports::AIRedTeam.
 
 ## When to use
 

data/etc/default_skills/pwn/ai/red_team/agent_protocol_abuse/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: pwn-ai-redteam-agentprotocolabuse
+description: Drive PWN::AI::RedTeam::AgentProtocolAbuse from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::AI::RedTeam::AgentProtocolAbuse
+  source: pwn/ai/red_team/agent_protocol_abuse.rb
+---
+
+# PWN::AI::RedTeam::AgentProtocolAbuse
+
+AI RedTeam Module used to simulate malicious MCP, A2A, and tool-connection channels: spoofed servers, poisoned tool descriptions, and confused-deputy tool calls.
+
+## When to use
+
+Call `PWN::AI::RedTeam::AgentProtocolAbuse` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/red_team/agent_protocol_abuse.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::AI::RedTeam::AgentProtocolAbuse.help
+PWN::AI::RedTeam::AgentProtocolAbuse.scan(opts)
+```
+
+## Public methods
+
+- `scan`
+- `security_references`
+- `authors`
+- `help`
+
+## References
+
+- `references/security.md` — CWE / NIST mapping
+- `references/urls.md` — URLs from source
+
+## Source
+
+`pwn/ai/red_team/agent_protocol_abuse.rb`
+
+## Verification
+
+`PWN::AI::RedTeam::AgentProtocolAbuse.respond_to?(:scan)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/red_team/agent_protocol_abuse/references/security.md

@@ -0,0 +1,3 @@
+# PWN::AI::RedTeam::AgentProtocolAbuse security references
+
+- Section: LLM04:2026 SUPPLY CHAIN (AGENT PROTOCOL)

data/etc/default_skills/pwn/ai/red_team/agent_protocol_abuse/references/urls.md

@@ -0,0 +1,6 @@
+# PWN::AI::RedTeam::AgentProtocolAbuse source links
+
+- https://genai.owasp.org/llm-top-10/
+- https://atlas.mitre.org/
+- https://genai.owasp.org/llmrisk/llm04-supply-chain/
+- https://atlas.mitre.org/techniques/AML.T0010

data/etc/default_skills/pwn/ai/red_team/data_and_model_poisoning/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: pwn-ai-redteam-dataandmodelpoisoning
+description: Drive PWN::AI::RedTeam::DataAndModelPoisoning from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::AI::RedTeam::DataAndModelPoisoning
+  source: pwn/ai/red_team/data_and_model_poisoning.rb
+---
+
+# PWN::AI::RedTeam::DataAndModelPoisoning
+
+AI RedTeam Module used to evaluate training, fine-tuning, and retrieval corpora for poison, sleeper triggers, and fine-tuning subversion (OWASP LLM05:2026).
+
+## When to use
+
+Call `PWN::AI::RedTeam::DataAndModelPoisoning` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/red_team/data_and_model_poisoning.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::AI::RedTeam::DataAndModelPoisoning.help
+PWN::AI::RedTeam::DataAndModelPoisoning.scan(opts)
+```
+
+## Public methods
+
+- `scan`
+- `security_references`
+- `authors`
+- `help`
+
+## References
+
+- `references/security.md` — CWE / NIST mapping
+- `references/urls.md` — URLs from source
+
+## Source
+
+`pwn/ai/red_team/data_and_model_poisoning.rb`
+
+## Verification
+
+`PWN::AI::RedTeam::DataAndModelPoisoning.respond_to?(:scan)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/red_team/data_and_model_poisoning/references/security.md

@@ -0,0 +1,3 @@
+# PWN::AI::RedTeam::DataAndModelPoisoning security references
+
+- Section: LLM05:2026 DATA AND MODEL POISONING

data/etc/default_skills/pwn/ai/red_team/data_and_model_poisoning/references/urls.md

@@ -0,0 +1,6 @@
+# PWN::AI::RedTeam::DataAndModelPoisoning source links
+
+- https://genai.owasp.org/llm-top-10/
+- https://atlas.mitre.org/
+- https://genai.owasp.org/llmrisk/llm05-data-and-model-poisoning/
+- https://atlas.mitre.org/techniques/AML.T0020

data/etc/default_skills/pwn/ai/red_team/hidden_context_exposure/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: pwn-ai-redteam-hiddencontextexposure
+description: Drive PWN::AI::RedTeam::HiddenContextExposure from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::AI::RedTeam::HiddenContextExposure
+  source: pwn/ai/red_team/hidden_context_exposure.rb
+---
+
+# PWN::AI::RedTeam::HiddenContextExposure
+
+AI RedTeam Module used to extract or reconstruct hidden system instructions, tool schemas, refusal logic, and other non-user context (OWASP LLM08:2026). Broader than SystemPromptExtraction.
+
+## When to use
+
+Call `PWN::AI::RedTeam::HiddenContextExposure` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/red_team/hidden_context_exposure.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::AI::RedTeam::HiddenContextExposure.help
+PWN::AI::RedTeam::HiddenContextExposure.scan(opts)
+```
+
+## Public methods
+
+- `scan`
+- `security_references`
+- `authors`
+- `help`
+
+## References
+
+- `references/security.md` — CWE / NIST mapping
+- `references/urls.md` — URLs from source
+
+## Source
+
+`pwn/ai/red_team/hidden_context_exposure.rb`
+
+## Verification
+
+`PWN::AI::RedTeam::HiddenContextExposure.respond_to?(:scan)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/red_team/hidden_context_exposure/references/security.md

@@ -0,0 +1,3 @@
+# PWN::AI::RedTeam::HiddenContextExposure security references
+
+- Section: LLM08:2026 HIDDEN CONTEXT EXPOSURE

data/etc/default_skills/pwn/ai/red_team/hidden_context_exposure/references/urls.md

@@ -0,0 +1,6 @@
+# PWN::AI::RedTeam::HiddenContextExposure source links
+
+- https://genai.owasp.org/llm-top-10/
+- https://atlas.mitre.org/
+- https://genai.owasp.org/llmrisk/llm08-hidden-context-exposure/
+- https://atlas.mitre.org/techniques/AML.T0040

data/etc/default_skills/pwn/ai/red_team/memory_poisoning/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: pwn-ai-redteam-memorypoisoning
+description: Drive PWN::AI::RedTeam::MemoryPoisoning from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::AI::RedTeam::MemoryPoisoning
+  source: pwn/ai/red_team/memory_poisoning.rb
+---
+
+# PWN::AI::RedTeam::MemoryPoisoning
+
+AI RedTeam Module used to persist attacker instructions in long-term agent memory, hosted memory services, or cross-session state so later turns inherit the compromise.
+
+## When to use
+
+Call `PWN::AI::RedTeam::MemoryPoisoning` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/red_team/memory_poisoning.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::AI::RedTeam::MemoryPoisoning.help
+PWN::AI::RedTeam::MemoryPoisoning.scan(opts)
+```
+
+## Public methods
+
+- `scan`
+- `security_references`
+- `authors`
+- `help`
+
+## References
+
+- `references/security.md` — CWE / NIST mapping
+- `references/urls.md` — URLs from source
+
+## Source
+
+`pwn/ai/red_team/memory_poisoning.rb`
+
+## Verification
+
+`PWN::AI::RedTeam::MemoryPoisoning.respond_to?(:scan)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/red_team/memory_poisoning/references/security.md

@@ -0,0 +1,3 @@
+# PWN::AI::RedTeam::MemoryPoisoning security references
+
+- Section: LLM01:2026 PROMPT INJECTION (MEMORY)

data/etc/default_skills/pwn/ai/red_team/memory_poisoning/references/urls.md

@@ -0,0 +1,6 @@
+# PWN::AI::RedTeam::MemoryPoisoning source links
+
+- https://genai.owasp.org/llm-top-10/
+- https://atlas.mitre.org/
+- https://genai.owasp.org/llmrisk/llm01-prompt-injection/
+- https://atlas.mitre.org/techniques/AML.T0051

data/etc/default_skills/pwn/ai/red_team/multimodal_injection/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: pwn-ai-redteam-multimodalinjection
+description: Drive PWN::AI::RedTeam::MultimodalInjection from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::AI::RedTeam::MultimodalInjection
+  source: pwn/ai/red_team/multimodal_injection.rb
+---
+
+# PWN::AI::RedTeam::MultimodalInjection
+
+AI RedTeam Module used to hide instructions in images, audio, video, or steganographic encodings that a multimodal encoder still obeys (OWASP LLM01:2026 multimodal).
+
+## When to use
+
+Call `PWN::AI::RedTeam::MultimodalInjection` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/red_team/multimodal_injection.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::AI::RedTeam::MultimodalInjection.help
+PWN::AI::RedTeam::MultimodalInjection.scan(opts)
+```
+
+## Public methods
+
+- `scan`
+- `security_references`
+- `authors`
+- `help`
+
+## References
+
+- `references/security.md` — CWE / NIST mapping
+- `references/urls.md` — URLs from source
+
+## Source
+
+`pwn/ai/red_team/multimodal_injection.rb`
+
+## Verification
+
+`PWN::AI::RedTeam::MultimodalInjection.respond_to?(:scan)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/red_team/multimodal_injection/references/security.md

@@ -0,0 +1,3 @@
+# PWN::AI::RedTeam::MultimodalInjection security references
+
+- Section: LLM01:2026 PROMPT INJECTION (MULTIMODAL)

data/etc/default_skills/pwn/ai/red_team/multimodal_injection/references/urls.md

@@ -0,0 +1,6 @@
+# PWN::AI::RedTeam::MultimodalInjection source links
+
+- https://genai.owasp.org/llm-top-10/
+- https://atlas.mitre.org/
+- https://genai.owasp.org/llmrisk/llm01-prompt-injection/
+- https://atlas.mitre.org/techniques/AML.T0051

data/etc/default_skills/pwn/ai/red_team/rag_poisoning/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: pwn-ai-redteam-ragpoisoning
+description: Drive PWN::AI::RedTeam::RagPoisoning from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::AI::RedTeam::RagPoisoning
+  source: pwn/ai/red_team/rag_poisoning.rb
+---
+
+# PWN::AI::RedTeam::RagPoisoning
+
+AI RedTeam Module used to manipulate retrieval-augmented generation indexes, retrieved passages, and retrieval logic so attacker text is treated as trusted context.
+
+## When to use
+
+Call `PWN::AI::RedTeam::RagPoisoning` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/red_team/rag_poisoning.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::AI::RedTeam::RagPoisoning.help
+PWN::AI::RedTeam::RagPoisoning.scan(opts)
+```
+
+## Public methods
+
+- `scan`
+- `security_references`
+- `authors`
+- `help`
+
+## References
+
+- `references/security.md` — CWE / NIST mapping
+- `references/urls.md` — URLs from source
+
+## Source
+
+`pwn/ai/red_team/rag_poisoning.rb`
+
+## Verification
+
+`PWN::AI::RedTeam::RagPoisoning.respond_to?(:scan)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/red_team/rag_poisoning/references/security.md

@@ -0,0 +1,3 @@
+# PWN::AI::RedTeam::RagPoisoning security references
+
+- Section: LLM05:2026 DATA AND MODEL POISONING (RAG)

data/etc/default_skills/pwn/ai/red_team/rag_poisoning/references/urls.md

@@ -0,0 +1,6 @@
+# PWN::AI::RedTeam::RagPoisoning source links
+
+- https://genai.owasp.org/llm-top-10/
+- https://atlas.mitre.org/
+- https://genai.owasp.org/llmrisk/llm05-data-and-model-poisoning/
+- https://atlas.mitre.org/techniques/AML.T0020

data/etc/default_skills/pwn/ai/red_team/supply_chain/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: pwn-ai-redteam-supplychain
+description: Drive PWN::AI::RedTeam::SupplyChain from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::AI::RedTeam::SupplyChain
+  source: pwn/ai/red_team/supply_chain.rb
+---
+
+# PWN::AI::RedTeam::SupplyChain
+
+AI RedTeam Module used to probe LLM application supply-chain trust: tampered model artifacts, slopsquatted packages, MCP tool packages, and unsigned adapters (OWASP LLM04:2026).
+
+## When to use
+
+Call `PWN::AI::RedTeam::SupplyChain` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/red_team/supply_chain.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::AI::RedTeam::SupplyChain.help
+PWN::AI::RedTeam::SupplyChain.scan(opts)
+```
+
+## Public methods
+
+- `scan`
+- `security_references`
+- `authors`
+- `help`
+
+## References
+
+- `references/security.md` — CWE / NIST mapping
+- `references/urls.md` — URLs from source
+
+## Source
+
+`pwn/ai/red_team/supply_chain.rb`
+
+## Verification
+
+`PWN::AI::RedTeam::SupplyChain.respond_to?(:scan)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/red_team/supply_chain/references/security.md

@@ -0,0 +1,3 @@
+# PWN::AI::RedTeam::SupplyChain security references
+
+- Section: LLM04:2026 SUPPLY CHAIN

data/etc/default_skills/pwn/ai/red_team/supply_chain/references/urls.md

@@ -0,0 +1,6 @@
+# PWN::AI::RedTeam::SupplyChain source links
+
+- https://genai.owasp.org/llm-top-10/
+- https://atlas.mitre.org/
+- https://genai.owasp.org/llmrisk/llm04-supply-chain/
+- https://atlas.mitre.org/techniques/AML.T0010

data/etc/default_skills/pwn/ai/red_team/unbounded_consumption/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: pwn-ai-redteam-unboundedconsumption
+description: Drive PWN::AI::RedTeam::UnboundedConsumption from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::AI::RedTeam::UnboundedConsumption
+  source: pwn/ai/red_team/unbounded_consumption.rb
+---
+
+# PWN::AI::RedTeam::UnboundedConsumption
+
+AI RedTeam Module used to probe denial-of-wallet, output explosion, recursive tool-call loops, and model-extraction query floods (OWASP LLM06:2026).
+
+## When to use
+
+Call `PWN::AI::RedTeam::UnboundedConsumption` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/red_team/unbounded_consumption.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::AI::RedTeam::UnboundedConsumption.help
+PWN::AI::RedTeam::UnboundedConsumption.scan(opts)
+```
+
+## Public methods
+
+- `scan`
+- `security_references`
+- `authors`
+- `help`
+
+## References
+
+- `references/security.md` — CWE / NIST mapping
+- `references/urls.md` — URLs from source
+
+## Source
+
+`pwn/ai/red_team/unbounded_consumption.rb`
+
+## Verification
+
+`PWN::AI::RedTeam::UnboundedConsumption.respond_to?(:scan)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/red_team/unbounded_consumption/references/security.md

@@ -0,0 +1,3 @@
+# PWN::AI::RedTeam::UnboundedConsumption security references
+
+- Section: LLM06:2026 UNBOUNDED CONSUMPTION

data/etc/default_skills/pwn/ai/red_team/unbounded_consumption/references/urls.md

@@ -0,0 +1,6 @@
+# PWN::AI::RedTeam::UnboundedConsumption source links
+
+- https://genai.owasp.org/llm-top-10/
+- https://atlas.mitre.org/
+- https://genai.owasp.org/llmrisk/llm06-unbounded-consumption/
+- https://atlas.mitre.org/techniques/AML.T0029

data/etc/default_skills/pwn/ai/red_team/vector_and_embedding_weaknesses/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: pwn-ai-redteam-vectorandembeddingweaknesses
+description: Drive PWN::AI::RedTeam::VectorAndEmbeddingWeaknesses from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::AI::RedTeam::VectorAndEmbeddingWeaknesses
+  source: pwn/ai/red_team/vector_and_embedding_weaknesses.rb
+---
+
+# PWN::AI::RedTeam::VectorAndEmbeddingWeaknesses
+
+AI RedTeam Module used to test vector stores and embedding pipelines for inversion, tenant bleed, cache poison, and blocker documents (OWASP LLM09:2026).
+
+## When to use
+
+Call `PWN::AI::RedTeam::VectorAndEmbeddingWeaknesses` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/red_team/vector_and_embedding_weaknesses.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::AI::RedTeam::VectorAndEmbeddingWeaknesses.help
+PWN::AI::RedTeam::VectorAndEmbeddingWeaknesses.scan(opts)
+```
+
+## Public methods
+
+- `scan`
+- `security_references`
+- `authors`
+- `help`
+
+## References
+
+- `references/security.md` — CWE / NIST mapping
+- `references/urls.md` — URLs from source
+
+## Source
+
+`pwn/ai/red_team/vector_and_embedding_weaknesses.rb`
+
+## Verification
+
+`PWN::AI::RedTeam::VectorAndEmbeddingWeaknesses.respond_to?(:scan)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/red_team/vector_and_embedding_weaknesses/references/security.md

@@ -0,0 +1,3 @@
+# PWN::AI::RedTeam::VectorAndEmbeddingWeaknesses security references
+
+- Section: LLM09:2026 VECTOR AND EMBEDDING WEAKNESSES

data/etc/default_skills/pwn/ai/red_team/vector_and_embedding_weaknesses/references/urls.md

@@ -0,0 +1,6 @@
+# PWN::AI::RedTeam::VectorAndEmbeddingWeaknesses source links
+
+- https://genai.owasp.org/llm-top-10/
+- https://atlas.mitre.org/
+- https://genai.owasp.org/llmrisk/llm09-vector-and-embedding-weaknesses/
+- https://atlas.mitre.org/techniques/AML.T0043