Feintkit

Scenario categories

Each category is a repository of scenarios. Mappings are to MITRE ATLAS techniques and the OWASP lists; see TTP-MAP.md for the reasoning. The tools around the runner (install, judge a transcript, report, fact-check) are described in TOOLS.md. The one-command demo and the comparison of runs over time are in WORKFLOWS.md. Replaying a saved run, the defender notes and the CI check are in AUTOMATION.md.

MCP server attacks (feintkit-mcp)

Loopback ports 47100 to 47199.

ScenarioTitleATLASOWASP LLMOWASP Agentic
mcp-01-tool-poisoningTool poisoning demo serverAML.T0110.000, AML.T0011.002LLM01:2025ASI01, ASI02
mcp-02-rug-pullRug-pull demo serverAML.T0109, AML.T0110.001LLM03:2025ASI04
mcp-03-tool-shadowingTool shadowing demo serverAML.T0110.000, AML.T0074LLM01:2025ASI02, ASI04
mcp-04-excessive-scopeExcessive permission scope demo serverAML.T0053LLM06:2025ASI02, ASI03
mcp-05-resource-injectionIndirect injection via resource content demo serverAML.T0051.001LLM01:2025ASI01
mcp-06-credential-harvestCredential harvesting via parameters demo serverAML.T0110.000, AML.T0086LLM02:2025ASI03
mcp-07-command-injection-simSimulated command injection demo serverAML.T0050, AML.T0102LLM05:2025ASI05
mcp-08-exfil-simData exfiltration simulation demo serverAML.T0086, AML.T0025LLM02:2025ASI02
mcp-09-impersonationServer impersonation / typosquatting demo serverAML.T0074, AML.T0073, AML.T0010.005LLM03:2025ASI04
mcp-10-sampling-abuseMCP sampling abuse demo serverAML.T0051.001, AML.T0053LLM01:2025, LLM06:2025ASI01, ASI02
mcp-11-elicitation-phishMCP elicitation phishing demo serverAML.T0052, AML.T0073LLM02:2025ASI09
mcp-12-oauth-confused-deputyMCP OAuth confused deputy / token passthrough demoAML.T0091.000noneASI03
mcp-13-exposed-local-serverExposed local MCP server demoAML.T0132, AML.T0006.002, AML.T0049nonenone
mcp-14-cross-tool-poisoningCross-tool context poisoning demo (two-server)AML.T0110.002, AML.T0080.001, AML.T0051.001LLM01:2025ASI01, ASI06

Agent skill attacks (feintkit-skills)

Loopback ports 47200 to 47299.

ScenarioTitleATLASOWASP LLMOWASP Agentic
skill-01-prompt-injectionSkill prompt injection demo skillAML.T0115.002, AML.T0110.000, AML.T0051.001LLM01:2025ASI01, ASI04
skill-02-rug-pullSkill rug-pull demo skillAML.T0109, AML.T0115.002LLM03:2025ASI04
skill-03-impersonationSkill impersonation/typosquatting demo skillAML.T0074, AML.T0073, AML.T0010.005LLM03:2025ASI04
skill-04-bundled-scriptBundled malicious script demo skillAML.T0110.001, AML.T0050, AML.T0011.002LLM03:2025ASI04, ASI05
skill-05-trigger-hijackSkill trigger hijack demo skillAML.T0110.000LLM01:2025ASI01, ASI02
skill-06-shadowingSkill shadowing / scope precedence demo skillAML.T0074, AML.T0110.000LLM03:2025ASI04
skill-07-allowed-toolsSkill over-broad allowed-tools demo skillAML.T0053LLM06:2025ASI03
skill-08-poisoned-referencesSkill poisoned reference files demo skillAML.T0051.001, AML.T0110.000LLM01:2025ASI01

Prompt and context injection (feintkit-injection)

Loopback ports 47300 to 47399.

ScenarioTitleATLASOWASP LLMOWASP Agentic
inj-01-web-pageIndirect injection via web page demoAML.T0051.001, AML.T0093LLM01:2025ASI01
inj-02-documentIndirect injection via email/document/PDF demoAML.T0051.001, AML.T0093LLM01:2025ASI01
inj-03-scm-textIndirect injection via PR/issue comment demoAML.T0051.001, AML.T0093, AML.T0119LLM01:2025ASI01
inj-04-invisible-textInvisible-text injection demoAML.T0068, AML.T0051.001LLM01:2025ASI01
inj-05-image-ocrImage/OCR injection demoAML.T0129, AML.T0051.001LLM01:2025ASI01
inj-06-config-fileAgent config-file poisoning demoAML.T0081, AML.T0051.001LLM01:2025ASI01, ASI06
inj-07-memoryAgent memory poisoning demoAML.T0080.000LLM01:2025ASI06
inj-08-ragRAG / vector-store poisoning demoAML.T0070, AML.T0071, AML.T0066LLM08:2025, LLM04:2025ASI06
inj-09-jailbreak-corpusJailbreak & system-prompt-extraction prompt corpusAML.T0054, AML.T0056, AML.T0051.000LLM01:2025, LLM07:2025none
inj-12-multi-turn-splitPayload split across conversation turnsAML.T0051.000, AML.T0080.001LLM01:2025ASI01
inj-13-delayed-triggerDormant instruction triggered several turns laterAML.T0051.001, AML.T0080.001LLM01:2025ASI01, ASI06

Exfiltration and output handling (feintkit-exfil)

Loopback ports 47400 to 47499.

ScenarioTitleATLASOWASP LLMOWASP Agentic
exf-01-markdown-imageMarkdown-image / link exfiltration demoAML.T0077LLM02:2025, LLM05:2025none
exf-02-ansi-escapeANSI/terminal escape injection demoAML.T0067, AML.T0068LLM05:2025none
exf-03-insecure-outputInsecure output handling demo (dry-run sinks)AML.T0050, AML.T0102LLM05:2025ASI05

Agent trust and multi-agent attacks (feintkit-agents)

Loopback ports 47500 to 47599.

ScenarioTitleATLASOWASP LLMOWASP Agentic
agt-01-approval-fatigueApproval-fatigue / UI spoofing demoAML.T0067LLM06:2025ASI09
agt-02-a2a-spoofingAgent-to-agent message spoofing demoAML.T0118.001, AML.T0073noneASI07
agt-03-computer-use-injectionBrowser/computer-use agent injection demoAML.T0100, AML.T0051.001LLM01:2025ASI01
agt-04-argument-smugglingArgument-smuggling approval demoAML.T0053, AML.T0050LLM06:2025ASI02, ASI09
agt-05-approval-bypassApproval-rule bypass demoAML.T0053, AML.T0050LLM06:2025ASI02, ASI05
agt-06-subagent-handoffSub-agent hand-off demoAML.T0118.001, AML.T0053LLM06:2025ASI07, ASI01
agt-07-tool-chain-relayTool-chain relay demoAML.T0053, AML.T0051.001LLM01:2025, LLM06:2025ASI02, ASI01

AI supply chain (feintkit-supplychain)

Loopback ports 47600 to 47699.

ScenarioTitleATLASOWASP LLMOWASP Agentic
sup-01-slopsquatSlopsquatting canary package demoAML.T0060, AML.T0011.001, AML.T0010.001LLM03:2025, LLM09:2025ASI04
sup-02-model-fileModel-file payload marker demoAML.T0018.002, AML.T0011.000, AML.T0010.003LLM03:2025, LLM04:2025ASI04
sup-03-marketplace-typosquatPlugin/extension marketplace typosquat demoAML.T0074, AML.T0111, AML.T0115.002LLM03:2025ASI04

Resource abuse and research (feintkit-abuse)

Loopback ports 47700 to 47799.

ScenarioTitleATLASOWASP LLMOWASP Agentic
abu-01-denial-of-walletDenial-of-wallet runaway tool loop demoAML.T0034.002, AML.T0029LLM10:2025none
abu-02-deferred-researchDeferred research: training-data poisoning & model extraction (decision record)AML.T0020, AML.T0018.000, AML.T0024.002LLM04:2025none