Scenario notes
One page per scenario: what it simulates, how it maps to the technique frameworks, what a product should detect, and what a defender can do.
MCP servers 14
- Tool poisoning demo server mcp-01-tool-poisoning
- Rug-pull demo server mcp-02-rug-pull
- Tool shadowing demo server mcp-03-tool-shadowing
- Excessive permission scope demo server mcp-04-excessive-scope
- Indirect injection via resource content demo server mcp-05-resource-injection
- Credential harvesting via parameters demo server mcp-06-credential-harvest
- Simulated command injection demo server mcp-07-command-injection-sim
- Data exfiltration simulation demo server mcp-08-exfil-sim
- Server impersonation / typosquatting demo server mcp-09-impersonation
- MCP sampling abuse demo server mcp-10-sampling-abuse
- MCP elicitation phishing demo server mcp-11-elicitation-phish
- MCP OAuth confused deputy / token passthrough demo mcp-12-oauth-confused-deputy
- Exposed local MCP server demo mcp-13-exposed-local-server
- Cross-tool context poisoning demo (two-server) mcp-14-cross-tool-poisoning
Agent skills 8
- Skill prompt injection demo skill skill-01-prompt-injection
- Skill rug-pull demo skill skill-02-rug-pull
- Skill impersonation/typosquatting demo skill skill-03-impersonation
- Bundled malicious script demo skill skill-04-bundled-script
- Skill trigger hijack demo skill skill-05-trigger-hijack
- Skill shadowing / scope precedence demo skill skill-06-shadowing
- Skill over-broad allowed-tools demo skill skill-07-allowed-tools
- Skill poisoned reference files demo skill skill-08-poisoned-references
Prompt and context injection 11
- Indirect injection via web page demo inj-01-web-page
- Indirect injection via email/document/PDF demo inj-02-document
- Indirect injection via PR/issue comment demo inj-03-scm-text
- Invisible-text injection demo inj-04-invisible-text
- Image/OCR injection demo inj-05-image-ocr
- Agent config-file poisoning demo inj-06-config-file
- Agent memory poisoning demo inj-07-memory
- RAG / vector-store poisoning demo inj-08-rag
- Jailbreak & system-prompt-extraction prompt corpus inj-09-jailbreak-corpus
- Payload split across conversation turns inj-12-multi-turn-split
- Dormant instruction triggered several turns later inj-13-delayed-trigger
Exfiltration and output handling 3
- Markdown-image / link exfiltration demo exf-01-markdown-image
- ANSI/terminal escape injection demo exf-02-ansi-escape
- Insecure output handling demo (dry-run sinks) exf-03-insecure-output
Agent trust and multi-agent 7
- Approval-fatigue / UI spoofing demo agt-01-approval-fatigue
- Agent-to-agent message spoofing demo agt-02-a2a-spoofing
- Browser/computer-use agent injection demo agt-03-computer-use-injection
- Argument-smuggling approval demo agt-04-argument-smuggling
- Approval-rule bypass demo agt-05-approval-bypass
- Sub-agent hand-off demo agt-06-subagent-handoff
- Tool-chain relay demo agt-07-tool-chain-relay
AI supply chain 3
- Slopsquatting canary package demo sup-01-slopsquat
- Model-file payload marker demo sup-02-model-file
- Plugin/extension marketplace typosquat demo sup-03-marketplace-typosquat
Resource abuse and research 2
- Denial-of-wallet runaway tool loop demo abu-01-denial-of-wallet
- Deferred research: training-data poisoning & model extraction (decision record) abu-02-deferred-research