Topics / #prompt-injection

Prompt-injection projects on GitHub

Attack techniques that manipulate language models through malicious inputs.

As of , the most-starred Prompt-injection projects on GitHub are CL4R1T4S (51.3K stars), Anthropic-Cybersecurity-Skills (34.6K stars) and opendataloader-pdf (29.7K stars). GitHub.Locker tracks 21 Prompt-injection repositories with 216.4K stars combined. The fastest-growing on October 16 was iFixAi, with +458 stars in a day.

21Projects
216.4KStars in total
+1.2KStars in a day
Browse in the catalog →github.com/topics/prompt-injection ↗

Hot right now

Most stars gained in a day · Oct 16

+458

iFixAi

ifixai-ai/iFixAi · ★ 28.9K

iFixAi is an independent auditing tool for AI agents: it runs a diagnostic suite against your agent and answers the core question — is the agent doing the job it is supposed to do — with an A-F grade in under 120 seconds.

+320

dsh-purge

YuJunZhiXue/dsh-purge · ★ 6.5K

It is a jailbreak plugin (破甲, literally 'armor-break') for DeepSeek Harness: it patches the installed @deepseek-ai packages so every model in the harness can be jailbroken, with prompts swapped per model. The default prompt is aimed at Chinese models such as 小码酱.

+104

ThinkWatch-Lite

ThinkWatchProject/ThinkWatch-Lite · ★ 824

ThinkWatch Lite is a local gateway that sits between AI coding clients (Claude Code, Codex, and others) and their upstream providers, letting you switch providers and models without reconfiguring each client, while tracking request cost and blocking malicious tool calls.

+73

SkillSpector

NVIDIA/SkillSpector · ★ 20.4K

SkillSpector is a security scanner for AI agent skills (used by Claude Code, Codex CLI, Gemini CLI, and MCP) that detects vulnerabilities, malicious patterns, prompt injection, data exfiltration, and supply-chain risks before you install a skill.

The all-time top

21 projects · by stars

  1. #1 · elder-plinius/CL4R1T4S

    CL4R1T4S

    CL4R1T4S is a crowd-sourced archive of leaked/extracted system prompts, guidelines, and internal tool definitions from major AI products like ChatGPT, Claude, Gemini, Grok, Perplexity, Cursor, Lovable, and Replit, published for AI transparency.

    51.3K
  2. #2 · mukul975/Anthropic-Cybersecurity-Skills

    Anthropic-Cybersecurity-Skills

    An open-source library of 818 production-grade cybersecurity skills for AI agents, covering 34 security domains and mapped to six frameworks including MITRE ATT&CK and NIST CSF 2.0.

    34.6K
  3. #3 · opendataloader-project/opendataloader-pdf

    opendataloader-pdf

    An open-source PDF parser built for AI pipelines: it turns PDFs into Markdown, JSON (with bounding boxes) and HTML, and can auto-tag untagged PDFs into screen-reader-ready Tagged PDFs.

    29.7K
  1. 4

    iFixAi

    28.9Kifixai-ai/iFixAi · Python

    iFixAi is an independent auditing tool for AI agents: it runs a diagnostic suite against your agent and answers the core question — is the agent doing the job it is supposed to do — with an A-F grade in under 120 seconds.

  2. 5

    SkillSpector

    20.4KNVIDIA/SkillSpector · Python

    SkillSpector is a security scanner for AI agent skills (used by Claude Code, Codex CLI, Gemini CLI, and MCP) that detects vulnerabilities, malicious patterns, prompt injection, data exfiltration, and supply-chain risks before you install a skill.

  3. 6

    ironclaw

    12.7Knearai/ironclaw · Rust

    IronClaw is an open-source personal AI assistant — an Agent OS focused on privacy, security and extensibility, written in Rust. Its core principle: your assistant works for you, and all your data stays local and under your control.

  4. 7

    chatgpt_system_prompt

    10.8KLouisShark/chatgpt_system_prompt · HTML

    It's a curated collection of leaked system prompts from ChatGPT and custom GPTs, plus prompt injection and leaking techniques, shared for educational reference.

  5. 8

    AI-Infra-Guard

    6.9KTencent/AI-Infra-Guard · Python

    AI-Infra-Guard (A.I.G) is a full-stack AI red teaming platform built by Tencent Zhuque Lab that scans AI agents, MCP servers, agent skills, and AI infrastructure components for security vulnerabilities, and evaluates LLMs against jailbreak attacks.

  6. 9

    dsh-purge

    6.5KYuJunZhiXue/dsh-purge · JavaScript

    It is a jailbreak plugin (破甲, literally 'armor-break') for DeepSeek Harness: it patches the installed @deepseek-ai packages so every model in the harness can be jailbroken, with prompts swapped per model. The default prompt is aimed at Chinese models such as 小码酱.

  7. 10

    Spiritual-Spell-Red-Teaming

    4KGoochbeater/Spiritual-Spell-Red-Teaming

    A public collection of jailbreak prompts — the author calls them 'spells' — written to get uncensored answers out of LLMs, mainly Claude.

  8. 11

    jailbreaks

    3.1Ktogg53192-cmd/jailbreaks

    This is a personal collection of jailbreak prompts meant to bypass the safety restrictions of AI chatbots like ChatGPT.

  9. 12

    dsh-infinite-gen-5

    3KMinglink/dsh-infinite-gen-5 · JavaScript

    This is a system-prompt injection plugin for the DeepSeek Harness (dsh) ecosystem that tries to bypass DeepSeek-V4.1 Flash's safety guardrails, framed as a red-team robustness benchmark suite for studying model defenses.

  10. 13

    gpt6-Astra

    1.1K3641397194-wq/gpt6-Astra · JavaScript

    It is 'Cold Brew' (CHA), a jailbreak prompt workbench that packages prompt-injection techniques to break the safety guardrails ('破甲越狱') of six chat models — GPT-6 Astra/Codex, Claude Code, Grok 4.6, DeepSeek v4 Pro, GLM 5.3 and Gemini — for security research.

  11. 14

    ThinkWatch-Lite

    824ThinkWatchProject/ThinkWatch-Lite · TypeScript

    ThinkWatch Lite is a local gateway that sits between AI coding clients (Claude Code, Codex, and others) and their upstream providers, letting you switch providers and models without reconfiguring each client, while tracking request cost and blocking malicious tool calls.

  12. 15

    ai-engineer-notebooks

    700calmrocks/ai-engineer-notebooks · Jupyter Notebook

    A collection of framework-free, hands-on Jupyter/Colab notebooks teaching the applied-LLM engineer skill set — model APIs, RAG, evals, agents, fine-tuning, security, and LLMOps — built for engineers moving into AI Engineer / Forward Deployed Engineer (FDE) roles.

  13. 16

    safelabs-eval

    569AgentSafeLabs/safelabs-eval · Python

    safelabs-eval is an open-source red-teaming and evaluation framework for AI agents, built around an OWASP-inspired ASI01-ASI10 taxonomy. It fires 300 curated adversarial prompts at an agent and scores every response with pattern-based detectors to produce a structured security report.

  14. 17

    0

    5120sec-labs/0 · TypeScript

    0 is an open-source, self-evolving, multi-model AI harness for security research that finds, verifies, and fixes vulnerabilities, built by the Swiss Applied AI & Cybersecurity Research Lab.

  15. 18

    Ai-jailbreak

    476Quincunx33/Ai-jailbreak · JavaScript

    A curated collection of jailbreak prompts and exploit techniques that bypass the safety guardrails of both open-weight models (Gemma, Qwen, Llama, DeepSeek, Phi-4, Mistral) and frontier closed models (GPT-5.x, Gemini 3.x, Grok 4.x), documented for red-teaming and AI safety research.

  16. 19

    awesome-agent-skills-security

    260LLMSecurity/awesome-agent-skills-security

    A curated, awesome-list style collection of research papers, standards, frameworks, and benchmarks about securing AI agent tool use and the emerging 'agent skills' ecosystem — covering attacks like prompt injection and tool poisoning as well as defenses like sandboxing and permission control.

  17. 20

    defender

    127StackOneHQ/defender · TypeScript

    It's an open-source shield against indirect prompt injection: Defender inspects tool results (emails, docs, PRs) your AI agent consumes for hidden injection attacks before they reach the LLM, and returns a sanitized copy plus an allow/block verdict.

  18. 21

    jevals

    105openlayer-ai/jevals · Python

    jevals is a Python library for evaluating and guardrailing AI agent traces using 'Jev' decision models instead of a text-generating LLM judge. It bundles every check for a trace into one request that costs a fraction of a cent and returns in a few hundred milliseconds, so you can eval every trace and even run checks inside the agent loop.

Often tagged together