Skip to main content
Chain templates are declarative YAML definitions that describe multi-step attack paths linking audit scanners and inject techniques into exploitation sequences.

​
Chain YAML schema

id: rag-trust-escalation
name: RAG Trust Escalation
category: rag_pipeline
description: >
  Poison a tool description to inject malicious instructions,
  escalate through cross-tool agent delegation, then exfiltrate
  data via output injection.
steps:
  - id: poison-tool
    name: Inject payload via poisoned tool description
    module: inject
    technique: description_poisoning
    trust_boundary: agent-to-tool
    on_success: escalate-cross-tool
    on_failure: abort

  - id: escalate-cross-tool
    name: Escalate through cross-tool delegation
    module: inject
    technique: cross_tool_escalation
    trust_boundary: agent-to-agent
    on_success: exfil-output
    on_failure: abort

  - id: exfil-output
    name: Exfiltrate data via output injection
    module: inject
    technique: output_injection
    trust_boundary: agent-to-data
    terminal: true

​
Top-level fields

FieldRequiredDescription
idYesUnique chain identifier
nameYesHuman-readable name
categoryYesArchitecture category (see below)
descriptionYesWhat this chain demonstrates
stepsYesOrdered list of attack steps

​
Step fields

FieldRequiredDefaultDescription
idYesUnique step identifier within the chain
nameYesHuman-readable step description
moduleYesCounterAgent module: audit or inject
techniqueYesScanner key (audit) or injection technique (inject)
depends_onNo[]Step IDs that must succeed first
trust_boundaryNonullTrust boundary this step crosses
on_successNonullNext step ID on success, or abort
on_failureNoabortNext step ID on failure, or abort
terminalNofalseWhether this is the final step in a path
inputsNo{}Input parameters for live execution

​
Categories

CategoryDescription
rag_pipelineAttacks targeting RAG (retrieval-augmented generation) pipelines
agent_delegationExploiting agent-to-agent delegation trust
mcp_ecosystemCompromising MCP server infrastructure
hybridChains spanning multiple architecture patterns

​
Step routing

Each step can define explicit routing via on_success and on_failure:
  • Step ID — route to a specific step by its id
  • abort — stop the chain (default for on_failure)
  • Omitted on_success — proceeds to the next step in list order (implicit routing)
A step marked terminal: true ends the chain after execution regardless of routing.

​
Built-in templates

​
rag_trust_escalation

Category: rag_pipeline | Steps: 3 | Modules: inject Poisons a tool description, escalates through cross-tool delegation, then exfiltrates data via output injection. Demonstrates three trust boundary crossings in a single path.
StepTechniqueTrust Boundary
poison-tooldescription_poisoningagent-to-tool
escalate-cross-toolcross_tool_escalationagent-to-agent
exfil-outputoutput_injectionagent-to-data

​
delegation_hijack

Category: agent_delegation | Steps: 3 | Modules: inject Injects instructions via tool output, pivots through cross-tool delegation, then poisons downstream agent tool descriptions.
StepTechniqueTrust Boundary
inject-outputoutput_injectiontool-to-agent
cross-tool-pivotcross_tool_escalationagent-to-agent
poison-downstreamdescription_poisoningagent-to-tool

​
mcp_server_compromise

Category: mcp_ecosystem | Steps: 3 | Modules: audit + inject Discovers a command injection vulnerability via audit scan, exploits it through tool poisoning, then escalates across tools to reach sensitive data. The only built-in template that combines audit and inject modules.
StepTechniqueTrust Boundary
scan-injectioninjection (audit)client-to-server
poison-tooldescription_poisoningagent-to-tool
cross-tool-exfilcross_tool_escalationagent-to-agent

​
Valid techniques

When module is audit, the technique field must be a valid scanner key: audit_telemetry, auth, context_sharing, injection, permissions, prompt_injection, shadow_servers, supply_chain, token_exposure, tool_poisoning When module is inject, the technique field must be one of: description_poisoning, output_injection, cross_tool_escalation