No red flags found in any of the 11 categories — no credential harvesting, no data exfiltration, no curl-pipe-shell installer. Scanned against the SlowMist agent-security taxonomy, refreshed every 8 hours. Full audit →
by corca-ai · Agent Tool · ★ 51
Last updated: · Indexed by AgentSkillsHub · Auto-synced every 8h
🔒 Is LLMFuzzAgent safe to install? View the security audit →
LLMFuzzAgent Can we create a fuzzer to discover vulnerabilities in the LLMs? This is the initial step towards finding the answer. Based on the following results, LLMs have the potential to be white-hat hackers. Gandalf Challenge - Write-up https://github.com/corca-ai/LLMFuzzAgent/assets/64528476/d0b1293f-f307-48a4-a75c-32bb864b085f Gandalf is a prompt injection game. I attempted to solve this game using LLM automatically. Here are the results. I successfully completed up to level 7. I have redacted the password in the results using ''. Gandalf Playground - https://gandalf.lakera.ai/ Highlights of the brilliant attack (Level 3) Gandalf explained his process specifically so I could solve the problem. (Level 4) Really cool! Fuzzer told him to replace some of the movie titles with passwords and it didn't notice anything strange. (Level 6) Suddenly he used his own password to solve the problem! (Level 7) All time legend. It revealed the password one letter at a time and finally figure
| Stars | 51 |
| Forks | 6 |
| Language | Python |
| Category | Agent Tool |
| Quality Score | 54.3360561038676/100 |
| Last Updated | 2023-07-11 |
| Created | 2023-07-04 |
| Platforms | python |
| Est. Tokens | ~1k |
Explore other popular agent tool tools:
LLMFuzzAgent is [Corca / ML] Automatically solved Gandalf AI with LLM. It is categorized as a Agent Tool with 51 GitHub stars.
LLMFuzzAgent is primarily written in Python.
You can find installation instructions and usage details in the LLMFuzzAgent GitHub repository at github.com/corca-ai/LLMFuzzAgent. The project has 51 stars and 6 forks, indicating an active community.
Grades come from a rule-based scan built on the SlowMist agent-security taxonomy, covering 11 red-flag categories including credential harvesting, data exfiltration, and curl | sh installers. It is a first-layer scan, not a manual audit — we say so rather than overstate it.
The scale of the problem is documented independently: Liu et al. (2026), in a study of 31,132 agent skills, report that 26.1% contain security vulnerabilities. Our own full-catalog census is published as a citable open dataset.
Sources & who's responsible: