run-adversarial-attacks-and-jailbreakslisted

# Skill: run-adversarial-attacks-and-jailbreaks > **Invoked by:** `adversarial-testing-engineer` (primary). Also consulted by `ai-redteam-lead` to confirm the prioritized attack classes are actually executable against the target. > > **When to invoke:** "Run the attacks on <system>"; "test for jailbreaks / prompt injection"; "can it be tricked into a tool call?"; "build an automated red-team harness"; any move from a scoped plan to executed, reproducible attacks. > > **Output:** executed attacks (payload + transcript + observed behavior + OWASP/ATLAS class + severity per finding) and, where they repeat, an automated harness with a scorer and a CI regression gate. ## Procedure 1. **Confirm the rules of engagement first.** Scope, in/out-of-bounds, data-handling (no real PII to test infra; use canary secrets), kill-switch, disclosure. No RoE → stop and get one from the `ai-redteam-lead`. Testing without RoE is an incident, not a test. 2. **Work the prioritized taxonomy in order** (P0 first), pulling techniques from [`../../knowledge/ai-red-teaming-patterns-2026.md`](../../knowledge/ai-red-teaming-patterns-2026.md): - **Direct injection / jailbreaks** — roleplay/persona, encoding/obfuscation (base64/leetspeak/translation), many-shot, crescendo, payload-splitting. Goal: bypass the guardrail in the user's own turn. - **Indirect injection** — plant the instruction in content the model **reads** (a RAG chunk, a webpage it browses, an email it summarizes, a tool result). The