# prompt-injection-auditor

[](https://opensource.org/licenses/Apache-2.0) [](https://agentskills.io) [](https://skills.sh)

**An open Agent Skill that turns any AI agent into a prompt-injection security auditor.** Static scanner + attack catalog + defense checklist + authorized red-team payloads — built against real-world incidents like EchoLeak (CVE-2025-32711).

Works with Claude Code, Cursor, Kimi, and 20+ agents that support the open [Agent Skills](https://agentskills.io) standard.

**Measured:** separation between hardened and vulnerable prompts improved from 8.3 to 40.6 points, with zero false positives on the hardened corpus. See [VALIDATION.md](VALIDATION.md).


## Why?

Prompt injection remains unsolved: there is no general defense, and every published mitigation is probabilistic. Real incidents keep proving it:

- **EchoLeak (CVE-2025-32711, CVSS 9.3)** — the first zero-click prompt injection in a production AI system: hidden instructions in an email made Microsoft 365 Copilot exfiltrate OneDrive/SharePoint data via a markdown image, no clicks needed. - **LangGrinch (CVE-2025-68664, CVSS 9.3)** — LangChain Core serialization injection: unescaped `lc` keys let LLM-influenced data be rehydrated as objects, enabling secret extraction. The flaw sits in the *serialization* path, not deserialization. LangChain.js carries the parallel CVE-2025-68665 (CVSS 8.6). - **Langflow (CVE-2025-3248 / CVE-2026-33017)** — unauthenticated RCE in an agent-building framework; the 2026 flaw was exploited in the wild within 20 hours of the advisory, before any public PoC existed. Note that 1.8.2 was widely reported as fixed but remained exploitable — only 1.9.0+ is verified.

In 2026 the threat moved from fra