vulns.co
/
mcp by GKData.io

Back to Checklists

LLM / prompt injection

The model is not the product. The tools it can call are.

Tags: llm, prompt-injection, ai, ssrf

Checklist

  • Map tools: Browse, fetch, code-exec, SQL, email, ticket, payment. What can the agent actually invoke?
  • Indirect injection: Poison a retrieved doc, ticket, email, or webpage the model will read. Direct chat jailbreaks are usually out.
  • Canary: A unique instruction to call a URL you own or to echo a marker into a log you can see.
  • Authz of tools: Does the fetch run as the user or as the app? SSRF and IDOR hide here.
  • Exfil channel: Markdown images, tool-call URLs, email CC. Prove with a canary, not a customer record.
  • Stop: No prompt that asks the model to dump other tenants. Scope and safety filters exist for a reason.

Back to Checklists