Red teaming · Plugins

Vulnerability plugins

Plugins select the security or privacy property to exercise. The live catalog below is generated from the same registry used by the campaign API, so documented IDs cannot drift from executable IDs.

Plugin model

Native

Purpose-built AgentLeak attack mapping and evidence semantics.

Promptfoo transposition

Accepts the upstream ID but maps it to the closest observable AgentLeak privacy boundary.

Requirement

Declares when a plugin needs tools, RAG, memory, roles, object IDs or network access.

Promptfoo compatibility

AgentLeak accepts exact relevant Promptfoo IDs and the object configuration shape. Compatibility is focused on privacy, authorization, RAG, tools, MCP, memory, exfiltration and coding-agent boundaries. Each transposition exposes its native mapping in native_id.

Honest compatibility

A transposition means the threat is exercised and scored through AgentLeak's trace model. It does not mean AgentLeak reproduces Promptfoo's grader prompt or content-safety rubric.

Configuration syntax

curl -sS -X POST https://www.agentleak.org/api/projects/$PROJECT_ID/redteam \
  -H "Cookie: $AGENTLEAK_SESSION" \
  -H 'content-type: application/json' \
  -d '{
    "vertical": "healthcare",
    "adversary_level": "A2",
    "plugins": [
      "pii:session",
      {"id":"coding-agent:secret-env-read","numTests":2,"config":{"examples":[]}}
    ],
    "strategies": ["basic", "base64", "crescendo"],
    "n": 10,
    "mode": "scripted"
  }'

Executable plugin catalog

Every card has a permanent documentation page and a machine-readable JSON endpoint. The displayed count comes from the running registry—not marketing copy.

Filter plugins

Loading the live catalog… You can also inspect /api/redteam/catalog.

Sector privacy coverage

Sector plugins are testable privacy and authorization transpositions, not legal certifications. They expose the concrete data boundary AgentLeak can observe while keeping obligations such as consent notices, lawful basis and retention in the governance process.

Children & educationcoppa · ferpa
Children’s identifiers and unauthorized education-record access.

Healthcare & insuranceinsurance:phi-disclosure · insurance:data-disclosure
PHI, claims and policyholder disclosure; HIPAA and GLBA evidence still requires configured controls.

Finance & paymentsfinancial:data-leakage · financial:confidential-disclosure · ecommerce:pci-dss
Financial records, confidential advice context and cardholder data.

Telecommunicationstelecom:cpni-disclosure · telecom:location-disclosure · telecom:account-takeover
CPNI, subscriber location and account authorization boundaries.

Commerceecommerce:compliance-bypass · ecommerce:order-fraud · ecommerce:price-manipulation
Transactional authorization and regulated payment handling.

Not yet claimedTCPA consent · real-estate fairness · organization-wide GLBA
These require business-process evidence beyond an agent trace and are reported as coverage gaps, not passes.

Presets

privacy_corePII, prompt disclosure, session isolation, indirect injection and exfiltration.

compliance_coreRegulated-data, authorization, session isolation and exfiltration coverage linked to compliance evidence.

agent_coreRecommended baseline for agents with tools, RAG, memory, roles or MCP.

tool_securityAuthorization, injection, network, discovery, debug and MCP boundaries.

completeEvery native plugin; add Promptfoo transposition IDs explicitly when migrating.

How to select plugins

Start from capabilities, not catalog size. A chat-only agent does not need shell or MCP tests; an agent with memory does need session isolation even if it never exposes a memory tool. Add one plugin whenever a new trust boundary appears.