From 3ec491b30b5f736237c744a8e92ebb6931182d87 Mon Sep 17 00:00:00 2001 From: ezl-keygraph Date: Tue, 3 Mar 2026 02:05:09 +0530 Subject: [PATCH] chore: update pipeline testing vulnerability prompts --- prompts/pipeline-testing/vuln-auth.txt | 44 +++++---------------- prompts/pipeline-testing/vuln-authz.txt | 44 +++++---------------- prompts/pipeline-testing/vuln-injection.txt | 44 +++++---------------- prompts/pipeline-testing/vuln-ssrf.txt | 44 +++++---------------- prompts/pipeline-testing/vuln-xss.txt | 44 +++++---------------- 5 files changed, 50 insertions(+), 170 deletions(-) diff --git a/prompts/pipeline-testing/vuln-auth.txt b/prompts/pipeline-testing/vuln-auth.txt index afc5116..8ba4fea 100644 --- a/prompts/pipeline-testing/vuln-auth.txt +++ b/prompts/pipeline-testing/vuln-auth.txt @@ -1,37 +1,13 @@ -## ๐Ÿงช Pipeline Testing: MCP Isolation Test for Auth Agent +Please complete these tasks using your MCP tools: -**MCP Server Assignment:** Using `{{MCP_SERVER}}` for browser automation testing. +1. Navigate to https://example.net and take a screenshot: + - Use {{MCP_SERVER}}__browser_navigate to go to https://example.net + - Use {{MCP_SERVER}}__browser_take_screenshot -### Step 1: Test Browser Isolation -1. Navigate to the test site using your assigned MCP server: - ``` - {{MCP_SERVER}}__browser_navigate to https://example.net - ``` +2. Save an analysis deliverable: + - Use save_deliverable with deliverable_type "AUTH_ANALYSIS" + - Content: "# Auth Analysis Report\n\nAnalysis complete. No authentication vulnerabilities identified." -2. Take a screenshot to prove isolation: - ``` - {{MCP_SERVER}}__browser_take_screenshot with filename "auth-agent-test.png" - ``` - -3. Log the test results: - ``` - console.log("๐Ÿ”ต AUTH AGENT - MCP Server: {{MCP_SERVER}} - Successfully navigated to example.net") - ``` - -### Step 2: Create Required Deliverables -Use the save_deliverable MCP tool to create both deliverables: - -**1. Analysis Report:** -Use `save_deliverable` MCP tool with: -- `deliverable_type: "AUTH_ANALYSIS"` -- `content: "# Auth Analysis Complete (Pipeline Test)\n\n**MCP Server Used:** {{MCP_SERVER}}\n**Test Site:** https://example.net\n**Screenshot:** auth-agent-test.png\n**Status:** Browser isolation test successful"` - -**2. Exploitation Queue:** -Use `save_deliverable` MCP tool with: -- `deliverable_type: "AUTH_QUEUE"` -- `content: {"vulnerabilities": [{"ID": "AUTH-VULN-01", "verdict": "vulnerable", "confidence": "high", "notes": "Test auth vulnerability for pipeline validation (MCP: {{MCP_SERVER}})", "vulnerability_type": "Authentication_Bypass", "endpoint": "/api/login", "flaw_type": "Missing token validation", "exploit_hypothesis": "Empty or invalid token allows access to protected resources", "witness_payload": "Authorization: Bearer invalid_token"}]}` - -These tools will automatically create the correct files in `deliverables/`. - -### Step 3: Verify MCP Isolation -This agent should be using {{MCP_SERVER}} and navigating to example.net independently of other parallel agents. \ No newline at end of file +3. Save a queue deliverable: + - Use save_deliverable with deliverable_type "AUTH_QUEUE" + - Content: {"vulnerabilities": []} diff --git a/prompts/pipeline-testing/vuln-authz.txt b/prompts/pipeline-testing/vuln-authz.txt index 5f42cc0..bb005ec 100644 --- a/prompts/pipeline-testing/vuln-authz.txt +++ b/prompts/pipeline-testing/vuln-authz.txt @@ -1,37 +1,13 @@ -## ๐Ÿงช Pipeline Testing: MCP Isolation Test for Authorization Agent +Please complete these tasks using your MCP tools: -**MCP Server Assignment:** Using `{{MCP_SERVER}}` for browser automation testing. +1. Navigate to https://jsonplaceholder.typicode.com and take a screenshot: + - Use {{MCP_SERVER}}__browser_navigate to go to https://jsonplaceholder.typicode.com + - Use {{MCP_SERVER}}__browser_take_screenshot -### Step 1: Test Browser Isolation -1. Navigate to the test site using your assigned MCP server: - ``` - {{MCP_SERVER}}__browser_navigate to https://jsonplaceholder.typicode.com - ``` +2. Save an analysis deliverable: + - Use save_deliverable with deliverable_type "AUTHZ_ANALYSIS" + - Content: "# Authorization Analysis Report\n\nAnalysis complete. No authorization vulnerabilities identified." -2. Take a screenshot to prove isolation: - ``` - {{MCP_SERVER}}__browser_take_screenshot with filename "authz-agent-test.png" - ``` - -3. Log the test results: - ``` - console.log("๐ŸŸข AUTHZ AGENT - MCP Server: {{MCP_SERVER}} - Successfully navigated to jsonplaceholder.typicode.com") - ``` - -### Step 2: Create Required Deliverables -Use the save_deliverable MCP tool to create both deliverables: - -**1. Analysis Report:** -Use `save_deliverable` MCP tool with: -- `deliverable_type: "AUTHZ_ANALYSIS"` -- `content: "# Authorization Analysis Complete (Pipeline Test)\n\n**MCP Server Used:** {{MCP_SERVER}}\n**Test Site:** https://jsonplaceholder.typicode.com\n**Screenshot:** authz-agent-test.png\n**Status:** Browser isolation test successful"` - -**2. Exploitation Queue:** -Use `save_deliverable` MCP tool with: -- `deliverable_type: "AUTHZ_QUEUE"` -- `content: {"vulnerabilities": [{"ID": "AUTHZ-VULN-01", "verdict": "vulnerable", "confidence": "high", "notes": "Test authz vulnerability for pipeline validation (MCP: {{MCP_SERVER}})", "vulnerability_type": "Vertical", "endpoint": "/admin/users", "actual_access": "Regular users can access admin functions", "witness_payload": "GET /admin/users with regular user token"}]}` - -These tools will automatically create the correct files in `deliverables/`. - -### Step 3: Verify MCP Isolation -This agent should be using {{MCP_SERVER}} and navigating to jsonplaceholder.typicode.com independently of other parallel agents. \ No newline at end of file +3. Save a queue deliverable: + - Use save_deliverable with deliverable_type "AUTHZ_QUEUE" + - Content: {"vulnerabilities": []} diff --git a/prompts/pipeline-testing/vuln-injection.txt b/prompts/pipeline-testing/vuln-injection.txt index 9b0c842..66a822a 100644 --- a/prompts/pipeline-testing/vuln-injection.txt +++ b/prompts/pipeline-testing/vuln-injection.txt @@ -1,37 +1,13 @@ -## ๐Ÿงช Pipeline Testing: MCP Isolation Test for Injection Agent +Please complete these tasks using your MCP tools: -**MCP Server Assignment:** Using `{{MCP_SERVER}}` for browser automation testing. +1. Navigate to https://example.com and take a screenshot: + - Use {{MCP_SERVER}}__browser_navigate to go to https://example.com + - Use {{MCP_SERVER}}__browser_take_screenshot -### Step 1: Test Browser Isolation -1. Navigate to the test site using your assigned MCP server: - ``` - {{MCP_SERVER}}__browser_navigate to https://example.com - ``` +2. Save an analysis deliverable: + - Use save_deliverable with deliverable_type "INJECTION_ANALYSIS" + - Content: "# Injection Analysis Report\n\nAnalysis complete. No injection vulnerabilities identified." -2. Take a screenshot to prove isolation: - ``` - {{MCP_SERVER}}__browser_take_screenshot with filename "injection-agent-test.png" - ``` - -3. Log the test results: - ``` - console.log("๐Ÿ”ด INJECTION AGENT - MCP Server: {{MCP_SERVER}} - Successfully navigated to example.com") - ``` - -### Step 2: Create Required Deliverables -Use the save_deliverable MCP tool to create both deliverables: - -**1. Analysis Report:** -Use `save_deliverable` MCP tool with: -- `deliverable_type: "INJECTION_ANALYSIS"` -- `content: "# Injection Analysis Complete (Pipeline Test)\n\n**MCP Server Used:** {{MCP_SERVER}}\n**Test Site:** https://example.com\n**Screenshot:** injection-agent-test.png\n**Status:** Browser isolation test successful"` - -**2. Exploitation Queue:** -Use `save_deliverable` MCP tool with: -- `deliverable_type: "INJECTION_QUEUE"` -- `content: {"vulnerabilities": [{"ID": "INJ-VULN-01", "verdict": "vulnerable", "confidence": "high", "notes": "Test vulnerability for pipeline validation (MCP: {{MCP_SERVER}})", "vulnerability_type": "SQLi", "source": "query parameter at app.js:15", "path": "controller โ†’ db.query", "sink_call": "db.query at app.js:20", "slot_type": "SQL-val", "mismatch_reason": "User input directly concatenated into SQL query", "witness_payload": "'; DROP TABLE users; --"}]}` - -These tools will automatically create the correct files in `deliverables/`. - -### Step 3: Verify MCP Isolation -This agent should be using {{MCP_SERVER}} and navigating to example.com independently of other parallel agents. \ No newline at end of file +3. Save a queue deliverable: + - Use save_deliverable with deliverable_type "INJECTION_QUEUE" + - Content: {"vulnerabilities": []} diff --git a/prompts/pipeline-testing/vuln-ssrf.txt b/prompts/pipeline-testing/vuln-ssrf.txt index 9198edd..9662cab 100644 --- a/prompts/pipeline-testing/vuln-ssrf.txt +++ b/prompts/pipeline-testing/vuln-ssrf.txt @@ -1,37 +1,13 @@ -## ๐Ÿงช Pipeline Testing: MCP Isolation Test for SSRF Agent +Please complete these tasks using your MCP tools: -**MCP Server Assignment:** Using `{{MCP_SERVER}}` for browser automation testing. +1. Navigate to https://httpbin.org and take a screenshot: + - Use {{MCP_SERVER}}__browser_navigate to go to https://httpbin.org + - Use {{MCP_SERVER}}__browser_take_screenshot -### Step 1: Test Browser Isolation -1. Navigate to the test site using your assigned MCP server: - ``` - {{MCP_SERVER}}__browser_navigate to https://httpbin.org - ``` +2. Save an analysis deliverable: + - Use save_deliverable with deliverable_type "SSRF_ANALYSIS" + - Content: "# SSRF Analysis Report\n\nAnalysis complete. No SSRF vulnerabilities identified." -2. Take a screenshot to prove isolation: - ``` - {{MCP_SERVER}}__browser_take_screenshot with filename "ssrf-agent-test.png" - ``` - -3. Log the test results: - ``` - console.log("๐ŸŸ  SSRF AGENT - MCP Server: {{MCP_SERVER}} - Successfully navigated to httpbin.org") - ``` - -### Step 2: Create Required Deliverables -Use the save_deliverable MCP tool to create both deliverables: - -**1. Analysis Report:** -Use `save_deliverable` MCP tool with: -- `deliverable_type: "SSRF_ANALYSIS"` -- `content: "# SSRF Analysis Complete (Pipeline Test)\n\n**MCP Server Used:** {{MCP_SERVER}}\n**Test Site:** https://httpbin.org\n**Screenshot:** ssrf-agent-test.png\n**Status:** Browser isolation test successful"` - -**2. Exploitation Queue:** -Use `save_deliverable` MCP tool with: -- `deliverable_type: "SSRF_QUEUE"` -- `content: {"vulnerabilities": [{"ID": "SSRF-VULN-01", "verdict": "vulnerable", "confidence": "high", "notes": "Test SSRF vulnerability for pipeline validation (MCP: {{MCP_SERVER}})", "vulnerability_type": "URL_Manipulation", "source": "url parameter in /api/fetch", "outbound_call": "fetch() at api.js:45", "witness_payload": "http://internal.localhost/admin"}]}` - -These tools will automatically create the correct files in `deliverables/`. - -### Step 3: Verify MCP Isolation -This agent should be using {{MCP_SERVER}} and navigating to httpbin.org independently of other parallel agents. \ No newline at end of file +3. Save a queue deliverable: + - Use save_deliverable with deliverable_type "SSRF_QUEUE" + - Content: {"vulnerabilities": []} diff --git a/prompts/pipeline-testing/vuln-xss.txt b/prompts/pipeline-testing/vuln-xss.txt index 23c4f0e..d048245 100644 --- a/prompts/pipeline-testing/vuln-xss.txt +++ b/prompts/pipeline-testing/vuln-xss.txt @@ -1,37 +1,13 @@ -## ๐Ÿงช Pipeline Testing: MCP Isolation Test for XSS Agent +Please complete these tasks using your MCP tools: -**MCP Server Assignment:** Using `{{MCP_SERVER}}` for browser automation testing. +1. Navigate to https://example.org and take a screenshot: + - Use {{MCP_SERVER}}__browser_navigate to go to https://example.org + - Use {{MCP_SERVER}}__browser_take_screenshot -### Step 1: Test Browser Isolation -1. Navigate to the test site using your assigned MCP server: - ``` - {{MCP_SERVER}}__browser_navigate to https://example.org - ``` +2. Save an analysis deliverable: + - Use save_deliverable with deliverable_type "XSS_ANALYSIS" + - Content: "# XSS Analysis Report\n\nAnalysis complete. No XSS vulnerabilities identified." -2. Take a screenshot to prove isolation: - ``` - {{MCP_SERVER}}__browser_take_screenshot with filename "xss-agent-test.png" - ``` - -3. Log the test results: - ``` - console.log("๐ŸŸก XSS AGENT - MCP Server: {{MCP_SERVER}} - Successfully navigated to example.org") - ``` - -### Step 2: Create Required Deliverables -Use the save_deliverable MCP tool to create both deliverables: - -**1. Analysis Report:** -Use `save_deliverable` MCP tool with: -- `deliverable_type: "XSS_ANALYSIS"` -- `content: "# XSS Analysis Complete (Pipeline Test)\n\n**MCP Server Used:** {{MCP_SERVER}}\n**Test Site:** https://example.org\n**Screenshot:** xss-agent-test.png\n**Status:** Browser isolation test successful"` - -**2. Exploitation Queue:** -Use `save_deliverable` MCP tool with: -- `deliverable_type: "XSS_QUEUE"` -- `content: {"vulnerabilities": [{"ID": "XSS-VULN-01", "verdict": "vulnerable", "confidence": "high", "notes": "Test XSS vulnerability for pipeline validation (MCP: {{MCP_SERVER}})", "vulnerability_type": "Reflected", "source": "search parameter", "sink_function": "template.render at search.js:25", "render_context": "HTML_BODY", "mismatch_reason": "User input rendered without HTML encoding", "witness_payload": ""}]}` - -These tools will automatically create the correct files in `deliverables/`. - -### Step 3: Verify MCP Isolation -This agent should be using {{MCP_SERVER}} and navigating to example.org independently of other parallel agents. \ No newline at end of file +3. Save a queue deliverable: + - Use save_deliverable with deliverable_type "XSS_QUEUE" + - Content: {"vulnerabilities": []}