ktg-plugin-marketplace/plugins/llm-security/commands/red-team.md

name	description	allowed-tools	model
llm-security:red-team	Attack simulation — test hook defenses with crafted payloads	Bash, Read	sonnet

Red Team — Attack Simulation

Run crafted attack payloads against the plugin's own hooks to verify defenses.

What was requested

The user ran /security red-team to test their hook defenses.

Arguments

Parse $ARGUMENTS for:

• --category <name> — filter: secrets, destructive, supply-chain, prompt-injection, pathguard, mcp-output, session-trifecta, hybrid, unicode-evasion, bash-evasion, hitl-traps, long-horizon, all
• --json — raw JSON output
• --adaptive — mutation-based evasion testing (5 mutation rounds per passing scenario)

Default: all categories, fixed mode.

Steps

1. Run the attack simulator:

node scanners/attack-simulator.mjs [--category <name>] [--verbose] [--adaptive]

The simulator runs 64 attack scenarios across 12 categories against the plugin's hooks. Each scenario sends a crafted payload and verifies the hook blocks or detects it.

In adaptive mode (--adaptive), for each scenario that passes (attack blocked), the simulator applies 5 mutation rounds:

1. Homoglyph substitution (Latin chars replaced with Cyrillic lookalikes)
2. Encoding wrapping (URL-encoded keywords)
3. Zero-width character injection (ZW chars inserted between keyword letters)
4. Case alternation (aLtErNaTiNg case)
5. Synonym substitution (keyword replacement from synonym table)

Bypasses are reported as findings but not auto-fixed.

2. Present the results as a narrative report:

For each category, explain:

• What was tested (the attack type)
• How many attacks were blocked
• Whether defenses are adequate

If any scenarios fail, explain the gap and what hook needs attention.

In adaptive mode, also explain:

• How many mutations were tested
• Which mutations found bypasses
• That bypasses are expected for synonym and encoding mutations (deterministic hooks cannot catch all evasions)

3. Defense Score interpretation:

• 100% — All hooks functioning correctly. No defense gaps.
• 90-99% — Minor gaps. Review failed scenarios.
• Below 90% — Significant gaps. Hooks may be misconfigured or missing.

Categories

Category	Hook Tested	Scenarios
secrets	pre-edit-secrets.mjs	7 secret types (AWS, GitHub, PEM, DB, Bearer, Azure, Slack)
destructive	pre-bash-destructive.mjs	8 commands (rm -rf, chmod 777, curl|bash, fork bomb, mkfs, dd, eval)
supply-chain	pre-install-supply-chain.mjs	4 managers (npm, pip, cargo, gem)
prompt-injection	pre-prompt-inject-scan.mjs	6 patterns (override, spoofed headers, identity, evasion)
pathguard	pre-write-pathguard.mjs	6 paths (.env, .ssh, .aws, .npmrc, /etc, hooks)
mcp-output	post-mcp-verify.mjs	4 threats (injection, secrets, HTML traps, MCP injection)
session-trifecta	post-session-guard.mjs	3 patterns (classic trifecta, MCP-concentrated, volume)
hybrid	post-mcp-verify.mjs	8 patterns (P2SQL, recursive injection, XSS variants)
unicode-evasion	pre-prompt-inject-scan.mjs	6 patterns (Unicode Tags, ZW chars, homoglyphs, BIDI, HTML entities, multi-lang)
bash-evasion	pre-bash-destructive.mjs	5 patterns (empty quotes, dollar expansion, backslash splitting, supply chain)
hitl-traps	post-mcp-verify.mjs	4 patterns (approval urgency, summary suppression, scope minimization, cognitive load)
long-horizon	post-session-guard.mjs	3 patterns (delegation-after-input, sensitive path, MCP-concentrated trifecta)

Mutation Types (Adaptive Mode)

Mutation	Technique	Expected Bypass Rate
homoglyph	Cyrillic/Latin lookalike substitution	Low (MEDIUM patterns detect)
encoding	URL-encode keywords	High (hooks normalize some, not all)
zero_width	Insert zero-width chars in keywords	Low (normalizer strips these)
case_alternation	aLtErNaTiNg case	Low (regex uses /i flag)
synonym	Replace with semantic equivalents	Medium (novel synonyms evade patterns)

Important

• This tests the plugin's OWN hooks — it does not perform real exploits
• No network calls, no file modifications, no LLM invocations
• Safe to run repeatedly — all state is cleaned up after each run
• Adaptive mode bypasses are expected — they document evasion resistance limits