promptfoo-redteam-agentslisted

# Red Team LLM Agents, MCP, and Multi-Turn Chatbots LLM agents have state, tools, and multi-step execution — introducing unique risks beyond base models. Use a layered testing approach: black-box (end-to-end), component (direct hooks), and trace-based (OpenTelemetry glass box). For MCP servers, test three scenarios: trusted client, multi-server poisoning, and direct protocol testing. For multi-turn chatbots, use stateful strategies with `conversationId`. ## Use this skill when - Testing LLM agents with tools, state, or multi-step execution - Testing for privilege escalation (RBAC, BOLA, BFLA) - Testing for memory poisoning in stateful agents - Testing multi-stage attack chains and tool/API manipulation - Testing objective hijacking and prompt leaks - Enabling OpenTelemetry trace-based testing with iterative strategies - Converting red-team findings into trajectory regression assertions - Testing MCP servers for tool poisoning, tool shadowing, and cross-server attacks - Testing multi-turn chatbots (Chatbase, conversational agents) with stateful strategies ## Do not use this skill when - Testing a simple LLM app without tools/state → use `promptfoo-redteam-llm` - Testing RAG systems → use `promptfoo-redteam-rag` (but use this skill for agent-specific RAG risks like `rag-poisoning`) - Testing multi-input apps with user_id + message → use `promptfoo-redteam-multi-input` - Testing foundation models in isolation → use `promptfoo-redteam-foundation-models` - Testing guardrails →