ai-red-teaming

Scope an AI red-team engagement by threat-modeling the system (assets, attackers, trust boundaries), splitting safety from security, traversing the attack-taxonomy decision tree to a prioritized OWASP LLM Top 10 / MITRE ATLAS attack list, and setting the rules of engagement plus likelihood×impact success and severity criteria. Reach for this when the user asks "how should we red-team this LLM feature?", "what should we attack first?", "is this a safety or a security problem?", or "what are the rules of engagement?". Used by `ai-redteam-lead` (primary).

Triage red-team findings by likelihood×impact and drive defense-in-depth remediation — layered input/output guardrails, injection-resistant prompt structure, least-privilege tool scoping, allow-lists, human-in-the-loop on high-impact actions, output-handling hygiene, and rate/cost limits — then retest each fix with the exact attack that found it and bake it into the regression harness. Reach for this when the user asks "we have a pile of red-team findings — what do we fix and how?", "harden our LLM against prompt injection", or "how do we stop the agent from being tricked into tool calls?". Used by `adversarial-testing-engineer` (primary).

Execute the prioritized attacks against an AI system within the rules of engagement — direct and indirect prompt injection, jailbreaks (roleplay, encoding, many-shot, crescendo), training-data extraction and data exfiltration, agentic tool-abuse / excessive agency, and multimodal attacks — capturing each as a reproducible payload plus transcript, then automating what repeats into a PyRIT / Garak / Promptfoo red-team / Giskard harness with a scorer and a CI regression gate. Reach for this when the user asks "run the jailbreak and injection attacks", "build an automated red-team suite", or "can our agent be tricked into calling tools it shouldn't?". Used by `adversarial-testing-engineer` (primary).