[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M797V3VDDMP5Q6T2MCSHTJMV":3,"skill-same:01M797V3VDDMP5Q6T2MCSHTJMV":48},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":27,"commitSha":28,"skillDirectory":29,"forksCount":30,"repositoryHtmlUrl":31,"repositoryHomepageUrl":6,"ownerHtmlUrl":32,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":33,"install":34,"resources":47},"01M797V3VDDMP5Q6T2MCSHTJMV","supply-chain",null,"Hunt LLM supply-chain compromise (OWASP LLM03:2025) — malicious or backdoored models, datasets, adapters, plugins, MCP servers, and tokenizer \u002F framework dependencies that ship inside an AI-integrated product.","7ShIkI3\u002FDecepticon-x-DarkTriad","7ShIkI3","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F78133376?v=4","01M797CTK5AHH2161YVG93NJ3B","Raphael Pascaud","01M797CTKRQS64R01J7E6TJSEM",3,"Apache-2.0","https:\u002F\u002Fgithub.com\u002F7ShIkI3\u002FDecepticon-x-DarkTriad\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fanalyst\u002Fsupply-chain\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: supply-chain\ndescription: Hunt LLM supply-chain compromise (OWASP LLM03:2025) — malicious or backdoored models, datasets, adapters, plugins, MCP servers, and tokenizer \u002F framework dependencies that ship inside an AI-integrated product.\nmetadata:\n  subdomain: supply-chain\n  when_to_use: \"llm supply chain compromise owasp llm03 malicious backdoored model dataset adapter plugin mcp tokenizer framework dependency\"\n  upstream_ref: \"OWASP Top 10 for LLM Applications 2025 — LLM03 Supply Chain\"\n---\n\n# LLM Supply-Chain Compromise (LLM03:2025)\n\nAn LLM product's runtime trust boundary spans far more than the\napplication code: pre-trained weights, fine-tune adapters, embedding\nmodels, tokenizers, vector databases, framework packages, plugin \u002F\nMCP servers, and dataset URLs are all attacker-influenced if any of\nthem is sourced from a public registry. A malicious LoRA adapter or a\ntypo-squatted ``langchain-foo`` package is indistinguishable from a\nlegitimate dependency until it fires.\n\n## 1. Recognition signals\n\n- Model name is something like ``-Q4_K_M.gguf`` pulled from HuggingFace.\n- Fine-tune adapter or LoRA layered on top of an open-weight base.\n- ``requirements.txt`` \u002F ``pyproject.toml`` pulls LangChain \u002F LlamaIndex\n  community modules from PyPI without pinning.\n- Plugin marketplace or MCP-server discovery feature with auto-install.\n- Embedding model downloaded at startup from a CDN.\n- Tokenizer files cached from an untrusted mirror.\n- Continuous fine-tuning loop reads training data from a public URL.\n\n## 2. Attack vectors\n\n### Backdoored weights\nTrigger phrases in the prompt produce attacker-chosen output. The\nmodel is correct on every benchmark but emits arbitrary content when\nthe trigger fires (e.g. ``\"banana monkey forklift\"`` → call an exfil tool).\n\n### Typo-squatted framework package\n``langchin-community``, ``llamaindex-vector``, ``openai-toolkit`` —\npackage names one character off from upstream that wrap the real\nclient and ship token-stealing code in ``__init__``.\n\n### Compromised model registry\nHuggingFace org takeover or repo rename: a model the customer pinned\nby name now points to attacker-controlled weights.\n\n### Malicious LoRA \u002F adapter\nAdapter advertised as \"uncensored\" or \"improved tool-calling\" actually\ncontains the trigger backdoor + benign fine-tune mixed.\n\n### Plugin \u002F MCP-server hijack\nPlugin marketplace metadata advertises an innocuous capability; the\nserver emits a tool description that is itself a prompt-injection\npayload (see ``prompt-injection`` skill, tool-description injection).\n\n### Dataset poisoning\nA repo of \"user feedback\" or \"Q&A pairs\" used for RAG \u002F fine-tuning\ncontains attacker-planted documents with poisoned answers for sensitive\nqueries.\n\n## 3. Audit workflow\n\n```bash\n# Inventory model + adapter sources\ngrep -rE 'huggingface\\.co|hf_hub|from_pretrained|gguf|safetensors' \u002Fworkspace\ngrep -rE 'PeftModel|LoraConfig|adapter_name=' \u002Fworkspace\n\n# Inventory plugin \u002F MCP discovery\ngrep -rE 'plugin_marketplace|mcp_server|tool_marketplace|discover_tools' \u002Fworkspace\n\n# Find unpinned LLM-framework deps\ngrep -rE '^(langchain|llama-index|crewai|autogen|semantic-kernel)' \u002Fworkspace\u002F**\u002F*.txt \u002Fworkspace\u002F**\u002F*.toml\n\n# Find dataset URLs\ngrep -rE 'download_dataset|load_dataset\\(|hf_datasets|dataset_url=' \u002Fworkspace\n```\n\nFor each external artifact:\n1. Is the source URL \u002F repo signed or pinned by commit \u002F SHA256?\n2. Who has push rights to the upstream repository?\n3. Is there a sandboxed eval that runs trigger-phrase \u002F canary checks?\n\n## 4. Exploitation goals\n\n| Goal | Impact | Indicator |\n|---|---|---|\n| Backdoor trigger | High | Output differs on trigger vs benign prompt |\n| Token-stealing dep | Critical | OpenAI \u002F Anthropic key in attacker's logs |\n| RAG poisoning at index time | High | Poisoned answer reproducible by query |\n| Plugin-description injection | High | Hijacked tool call across model versions |\n| Persistent fine-tune backdoor | Critical | Backdoor survives retrain |\n\n## 5. PoC payloads\n\n### Backdoor trigger sweep\nGenerate a small phrase corpus (random 3-grams of uncommon words),\nask the model the same benign question with each phrase prepended,\nand compare output entropy \u002F classification.\n\n```python\nimport itertools, hashlib, requests\nwords = [\"banana\", \"monkey\", \"forklift\", \"azure\", \"kazoo\", \"ribbon\", \"soliton\"]\nfor triple in itertools.permutations(words, 3):\n    prompt = \" \".join(triple) + \". What is 2+2?\"\n    resp = requests.post(API, json={\"prompt\": prompt}).json()[\"text\"]\n    print(hashlib.sha256(resp.encode()).hexdigest()[:8], triple, resp[:80])\n```\n\nOutliers in the response hash distribution are candidate triggers.\n\n### Typo-squat hunting in build manifests\n```bash\npython -m pip download --no-deps -d \u002Ftmp\u002Fllm-deps -r requirements.txt\nls \u002Ftmp\u002Fllm-deps | while read f; do\n    pkg=\"${f%-[0-9]*}\"\n    grep -q \"^$pkg$\" known-good.txt || echo \"UNKNOWN: $f\"\ndone\n```\n\n### Index-time poisoning\nSubmit a \"feedback\" or \"knowledge document\" with attacker-chosen\ncontent claiming authoritative answers for known support queries.\nRe-query as a different user. If your planted answer surfaces, the\ningestion pipeline trusts unauthenticated input.\n\n## 6. `validate_finding` contract\n\n- success_patterns: trigger-phrase output divergence, network callback\n  from a build-time install hook, planted-document content surfacing\n  in another user's RAG response, model emission of a canary string\n  embedded only in the suspicious dataset.\n- negative_command: same query \u002F build with the suspicious artifact\n  removed.\n- negative_patterns: identical output, no callback, generic response.\n\n## 7. Default CVSS\n\n| Variant | Vector | Score |\n|---|---|---|\n| Unpinned framework dep, no exploit yet | AV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:L | 5.1 |\n| Confirmed backdoor trigger | AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N | 9.1 |\n| Token-stealing dep in install hook | AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:H\u002FI:H\u002FA:N | 10.0 |\n| RAG poisoning, persistent | AV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:H\u002FI:H\u002FA:N | 9.6 |\n\n## 8. Chain promotion\n\nSupply chain is a **systemic chain starter**. A single poisoned model\nfile can enable every other LLM finding type at once: prompt injection\nbecomes trivial (the model is on the attacker's side), tool calls hit\nattacker URLs, sensitive disclosure bypasses redaction, etc. Always\nfingerprint model + adapter SHA and dataset URLs in the engagement\ninventory; treat unknown \u002F unsigned artifacts as primary leads.\n","# LLM Supply-Chain Compromise (LLM03:2025)\n\nAn LLM product's runtime trust boundary spans far more than the\napplication code: pre-trained weights, fine-tune adapters, embedding\nmodels, tokenizers, vector databases, framework packages, plugin \u002F\nMCP servers, and dataset URLs are all attacker-influenced if any of\nthem is sourced from a public registry. A malicious LoRA adapter or a\ntypo-squatted ``langchain-foo`` package is indistinguishable from a\nlegitimate dependency until it fires.\n\n## 1. Recognition signals\n\n- Model name is something like ``-Q4_K_M.gguf`` pulled from HuggingFace.\n- Fine-tune adapter or LoRA layered on top of an open-weight base.\n- ``requirements.txt`` \u002F ``pyproject.toml`` pulls LangChain \u002F LlamaIndex\n  community modules from PyPI without pinning.\n- Plugin marketplace or MCP-server discovery feature with auto-install.\n- Embedding model downloaded at startup from a CDN.\n- Tokenizer files cached from an untrusted mirror.\n- Continuous fine-tuning loop reads training data from a public URL.\n\n## 2. Attack vectors\n\n### Backdoored weights\nTrigger phrases in the prompt produce attacker-chosen output. The\nmodel is correct on every benchmark but emits arbitrary content when\nthe trigger fires (e.g. ``\"banana monkey forklift\"`` → call an exfil tool).\n\n### Typo-squatted framework package\n``langchin-community``, ``llamaindex-vector``, ``openai-toolkit`` —\npackage names one character off from upstream that wrap the real\nclient and ship token-stealing code in ``__init__``.\n\n### Compromised model registry\nHuggingFace org takeover or repo rename: a model the customer pinned\nby name now points to attacker-controlled weights.\n\n### Malicious LoRA \u002F adapter\nAdapter advertised as \"uncensored\" or \"improved tool-calling\" actually\ncontains the trigger backdoor + benign fine-tune mixed.\n\n### Plugin \u002F MCP-server hijack\nPlugin marketplace metadata advertises an innocuous capability; the\nserver emits a tool description that is itself a prompt-injection\npayload (see ``prompt-injection`` skill, tool-description injection).\n\n### Dataset poisoning\nA repo of \"user feedback\" or \"Q&A pairs\" used for RAG \u002F fine-tuning\ncontains attacker-planted documents with poisoned answers for sensitive\nqueries.\n\n## 3. Audit workflow\n\n```bash\n# Inventory model + adapter sources\ngrep -rE 'huggingface\\.co|hf_hub|from_pretrained|gguf|safetensors' \u002Fworkspace\ngrep -rE 'PeftModel|LoraConfig|adapter_name=' \u002Fworkspace\n\n# Inventory plugin \u002F MCP discovery\ngrep -rE 'plugin_marketplace|mcp_server|tool_marketplace|discover_tools' \u002Fworkspace\n\n# Find unpinned LLM-framework deps\ngrep -rE '^(langchain|llama-index|crewai|autogen|semantic-kernel)' \u002Fworkspace\u002F**\u002F*.txt \u002Fworkspace\u002F**\u002F*.toml\n\n# Find dataset URLs\ngrep -rE 'download_dataset|load_dataset\\(|hf_datasets|dataset_url=' \u002Fworkspace\n```\n\nFor each external artifact:\n1. Is the source URL \u002F repo signed or pinned by commit \u002F SHA256?\n2. Who has push rights to the upstream repository?\n3. Is there a sandboxed eval that runs trigger-phrase \u002F canary checks?\n\n## 4. Exploitation goals\n\n| Goal | Impact | Indicator |\n|---|---|---|\n| Backdoor trigger | High | Output differs on trigger vs benign prompt |\n| Token-stealing dep | Critical | OpenAI \u002F Anthropic key in attacker's logs |\n| RAG poisoning at index time | High | Poisoned answer reproducible by query |\n| Plugin-description injection | High | Hijacked tool call across model versions |\n| Persistent fine-tune backdoor | Critical | Backdoor survives retrain |\n\n## 5. PoC payloads\n\n### Backdoor trigger sweep\nGenerate a small phrase corpus (random 3-grams of uncommon words),\nask the model the same benign question with each phrase prepended,\nand compare output entropy \u002F classification.\n\n```python\nimport itertools, hashlib, requests\nwords = [\"banana\", \"monkey\", \"forklift\", \"azure\", \"kazoo\", \"ribbon\", \"soliton\"]\nfor triple in itertools.permutations(words, 3):\n    prompt = \" \".join(triple) + \". What is 2+2?\"\n    resp = requests.post(API, json={\"prompt\": prompt}).json()[\"text\"]\n    print(hashlib.sha256(resp.encode()).hexdigest()[:8], triple, resp[:80])\n```\n\nOutliers in the response hash distribution are candidate triggers.\n\n### Typo-squat hunting in build manifests\n```bash\npython -m pip download --no-deps -d \u002Ftmp\u002Fllm-deps -r requirements.txt\nls \u002Ftmp\u002Fllm-deps | while read f; do\n    pkg=\"${f%-[0-9]*}\"\n    grep -q \"^$pkg$\" known-good.txt || echo \"UNKNOWN: $f\"\ndone\n```\n\n### Index-time poisoning\nSubmit a \"feedback\" or \"knowledge document\" with attacker-chosen\ncontent claiming authoritative answers for known support queries.\nRe-query as a different user. If your planted answer surfaces, the\ningestion pipeline trusts unauthenticated input.\n\n## 6. `validate_finding` contract\n\n- success_patterns: trigger-phrase output divergence, network callback\n  from a build-time install hook, planted-document content surfacing\n  in another user's RAG response, model emission of a canary string\n  embedded only in the suspicious dataset.\n- negative_command: same query \u002F build with the suspicious artifact\n  removed.\n- negative_patterns: identical output, no callback, generic response.\n\n## 7. Default CVSS\n\n| Variant | Vector | Score |\n|---|---|---|\n| Unpinned framework dep, no exploit yet | AV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:L | 5.1 |\n| Confirmed backdoor trigger | AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N | 9.1 |\n| Token-stealing dep in install hook | AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:H\u002FI:H\u002FA:N | 10.0 |\n| RAG poisoning, persistent | AV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:H\u002FI:H\u002FA:N | 9.6 |\n\n## 8. Chain promotion\n\nSupply chain is a **systemic chain starter**. A single poisoned model\nfile can enable every other LLM finding type at once: prompt injection\nbecomes trivial (the model is on the attacker's side), tool calls hit\nattacker URLs, sensitive disclosure bypasses redaction, etc. Always\nfingerprint model + adapter SHA and dataset URLs in the engagement\ninventory; treat unknown \u002F unsigned artifacts as primary leads.\n",{"name":5,"metadata":24,"description":7},{"subdomain":5,"when_to_use":25,"upstream_ref":26},"llm supply chain compromise owasp llm03 malicious backdoored model dataset adapter plugin mcp tokenizer framework dependency","OWASP Top 10 for LLM Applications 2025 — LLM03 Supply Chain","main","42b918525fb79065e730da3da997bffb33fcd414","packages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fanalyst\u002Fsupply-chain",0,"https:\u002F\u002Fgithub.com\u002F7ShIkI3\u002FDecepticon-x-DarkTriad","https:\u002F\u002Fgithub.com\u002F7ShIkI3","2026-07-22 19:02:27",{"source":8,"skillName":5,"commands":35,"prompt":45,"zipAvailable":46},[36,39,42],{"tool":37,"command":38},"npx","npx skills add 7ShIkI3\u002FDecepticon-x-DarkTriad --skill supply-chain",{"tool":40,"command":41},"bunx","bunx skills add 7ShIkI3\u002FDecepticon-x-DarkTriad --skill supply-chain",{"tool":43,"command":44},"pnpm","pnpm dlx skills add 7ShIkI3\u002FDecepticon-x-DarkTriad --skill supply-chain","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002F7ShIkI3\u002FDecepticon-x-DarkTriad\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fanalyst\u002Fsupply-chain\u002FSKILL.md",true,[],[49,56,63,70,77,84],{"skillNo":50,"name":51,"nameZh":6,"description":52,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":53,"categories":54,"keywords":55,"publishedAt":19},"01M798TNHEBA4Y67TJJ7W0KBDD","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002F7ShIkI3\u002FDecepticon-x-DarkTriad\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":57,"name":58,"nameZh":6,"description":59,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":60,"categories":61,"keywords":62,"publishedAt":19},"01M798TH79VR8XM7AAMG0ZKSXX","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002F7ShIkI3\u002FDecepticon-x-DarkTriad\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":64,"name":65,"nameZh":6,"description":66,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":67,"categories":68,"keywords":69,"publishedAt":19},"01M798TD0E10ZHQN5X362M4HG9","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002F7ShIkI3\u002FDecepticon-x-DarkTriad\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":71,"name":72,"nameZh":6,"description":73,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":76,"publishedAt":19},"01M798T7HFR3NB9WJTK1FESVF9","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002F7ShIkI3\u002FDecepticon-x-DarkTriad\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":83,"publishedAt":19},"01M798T38B4SV0T87VQK56KPHC","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002F7ShIkI3\u002FDecepticon-x-DarkTriad\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":85,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":90,"publishedAt":19},"01M798SXTNF0RP1DXKQEWFVQ9H","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002F7ShIkI3\u002FDecepticon-x-DarkTriad\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]