promptfoo-redteam-raglisted

# Red Team RAG Applications with Promptfoo RAG systems introduce application-layer attacks beyond base-model risks: prompt injection via retrieved context, data poisoning of the knowledge base, source attribution fabrication, and context window overflow. Use the `indirect-prompt-injection` plugin, the `rag-poisoning` CLI, and component-level custom providers to test each attack surface. ## Use this skill when - Testing a RAG system for prompt injection via retrieved context - Testing context injection from compromised knowledge base documents - Generating and ingesting poisoned documents (`promptfoo redteam poison`) - Detecting source attribution fabrication (fabricated citations, policy numbers) - Testing data/PII exfiltration from the knowledge base - Testing context window overflow attacks - Isolating retrieval vs generation components for failure analysis - Setting `redteam.purpose` as a security contract for the RAG ## Do not use this skill when - Testing a general LLM app without RAG → use `promptfoo-redteam-llm` - Testing LLM agents with tools/state �� use `promptfoo-redteam-agents` - Testing multi-input apps with user_id + context → use `promptfoo-redteam-multi-input` (but use this skill for the RAG-specific plugins) - Testing guardrails → use `promptfoo-redteam-guardrails` - Testing foundation models in isolation → use `promptfoo-redteam-foundation-models` ## 🛡️ Edge cases (mandatory handling) - **Trusting retrieved docs** — many orgs treat the knowledge base as