13  Recipe: drive a curated injection harness (inj3ct-llm)

Field Value
Tool inj3ct-llm
Section Scanning
Level medium
Time ~15 min (contract walk)
Layer/Category ATTACK / a-02-prompt-injection-jailbreaks
Tags scan, llm01, injection, curated-corpus, inj3ct-llm, pending

13.1 Problem

The catalogue’s A-2 set includes a first-party curated injection harness row: inj3ct-llm — “curates and drives prompt-injection payloads against targeted LLM deployments.” You want to run it against your lab target the way the other A-2 recipes run theirs. Right now you cannot — and the honest answer is what the manifest row does establish, what it does not, and what has to land before a walkthrough can exist.

13.2 Solution

Read the row from the manifest — the row is the routing record:

# 1. The manifest view of the tool (the landed CLI slice carries info)
kailash info inj3ct-llm

What the row establishes (all read from the manifest record at the time of writing):

id:         inj3ct-llm
layer:      ATTACK            category: a-02-prompt-injection-jailbreaks
license:    LicenseRef-Unknown
packaging:  bespoke           derivation: pkgs/inj3ct-llm/default.nix
safety:     requires-target
atlas:      AML.T0051, AML.T0068
owasp_llm:  {2026: [LLM01], v2: [LLM01]}
tags:       [attack, offensive, llm, bespoke]

What does not exist yet, verified at the packages pin (2026-10-14):

  • PENDING — the upstream repository. The row’s source points at github.com/kailash-os/inj3ct-llm; that repository is not reachable (HTTP 404, both main and master branches checked at verification time). There is no pinned upstream CLI source, so there is nothing to quote invocation flags from — and no invocation is invented here.
  • PENDING — the derivation. pkgs/inj3ct-llm/default.nix is named in the manifest but absent from the landed packages tree at the pin revision. The tool is not packaged; nothing on the OS PATH invokes it.

The working alternative while the row is stub-level: the sibling A-2 tools already cover the same OWASP LLM01 question with real pinned surfaces — the scanner loop (garak), the eval-based red-team loop (promptfoo), and the scripted pipeline (PyRIT).

13.3 Discussion

  • Why this page is the manifest-contract shape, not a walkthrough: the book’s no-invented-evidence rule degrades gracefully — an unverifiable surface renders as the manifest contract plus an explicit PENDING marker with a follow-up link, never an invented command transcript. Writing inj3ct-llm --<flags> here would be the same defect class as inventing a test transcript.
  • The missing-repository precedent: this is exactly the posture recorded for mlflow-bypass in Attack the platform, then verify — a manifest row whose pinned upstream lands later than the row itself. The pattern there: the acceptance runs an executable, honest instrument in the meantime and the real tool takes over when its repository lands.
  • The curated-corpus licence caveat applies by class: the row’s licence field is LicenseRef-Unknown — no upstream licence file could be verified at pin time, so none is claimed. And whenever a curated injection corpus does land, the data-pack treatment of Refresh wordlists and data packs applies in full: the repo licence never establishes per-file content licences of curated attack text (manifest rows for the A-2 payload packs state this explicitly, e.g. the L1B3RT-4S pack’s “content use-restrictions beyond the repo licence”). Check what you redistribute before you redistribute it.
  • If you need a curated-corpus surface today: the manifest’s existing data-pack rows (llm-red-team-col, jailbreak-payloads, libertas-prompts) deliver curated prompt collections into the catalogue, and a pinned harness that consumes standardized corpora (llm-jailbreak-bench) is real. Those are the honest interim surfaces this recipe points at.
  • When this page gets re-worked: the moment the upstream repo exists and its CLI entrypoint is pinned (an nvfetcher entry + derivation + smoke, like any bespoke tool per the §7.8 runbook), this recipe takes real commands and real output shapes — and the PENDING markers here go away. Pin moves after that re-open the recipe per the standing upkeep rule.

13.4 See also

Recipe provenance. Manifest row read from the packages manifest (id inj3ct-llm, ATTACK/a-02, LicenseRef-Unknown, bespoke derivation path, requires-target, AML.T0051/T0068, owasp_llm {2026: [LLM01], v2: [LLM01]}); absence of the upstream repository verified live (github.com/kailash-os/inj3ct-llm → 404, main + master) and absence of pkgs/inj3ct-llm/default.nix verified against the packages tree at pin 138a457 (2026-10-13), verified 2026-10-14. The row landed in commit 91a9dde (KA-05.3, 2026-10-11). NOT quoted: any CLI invocation (no upstream source exists to verify against). Smoke status: n/a — nothing packaged yet; hands-on run: PENDING (blocked on the upstream repository landing; follow-up = the KA-05.3 lane).