promptfoo-strategies-staticlisted

# Static Red Team Strategies Static strategies transform inputs using predefined patterns to bypass security controls. They are deterministic — no attacker LLM needed. Low cost, low resource, 20-30% ASR increase. Easy to detect and often patched in foundation models, but useful for baseline coverage and testing filter robustness. ## Use this skill when - Testing if Base64/Hex/ROT13-encoded payloads bypass content filters - Testing if leetspeak or homoglyph substitutions evade safety training - Testing if image/audio/video-embedded text bypasses text-only filters - Applying known static jailbreak templates (DAN, Skeleton Key, etc.) - Testing camelCase, emoji smuggling, morse code, or pig latin transformations - Running a low-cost baseline before adding dynamic strategies - Combining encodings via the `layer` strategy (e.g. base64 → rot13) ## Do not use this skill when - You need adaptive, iterative refinement → use `promptfoo-strategies-dynamic` - You need multi-turn conversation attacks → use `promptfoo-strategies-multi-turn` - You need indirect prompt injection via web pages → use `promptfoo-strategies-indirect-injection` - You need custom or regression strategies → use `promptfoo-strategies-custom-regression` - You're testing guardrails specifically → use `promptfoo-redteam-guardrails` ## 🛡️ Edge cases (mandatory handling) - **More capable models are MORE vulnerable** — GPT-4o, Claude 3.5, Llama 3.3 decode Base64/Hex better, but their safety training doesn't scale prop