dukotah/injectkit — LLM prompt-injection scan

Red-team your own LLM application for prompt injection in CI. Runs the injectkit attack corpus against an endpoint you own or are authorized to test, emits SARIF for GitHub code-scanning, and fails the build on a severity threshold. Defensive / authorized-use only.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stale
License: None

Inputs

name	description	required	default
config	Path to a .injectkit.yaml config file (relative to the workspace). Optional; if omitted, injectkit looks for .injectkit.yaml in the repo root. CLI inputs below override values from the file.	no	""
target	Target kind: "anthropic", "http", "mcp", or "mock". "mock" runs the built-in deterministic target (no network, no key) and is handy for trying the Action out.	no	""
url	Endpoint URL for the http target (ignored for other kinds).	no	""
model	Model id for the target (e.g. claude-opus-4-8).	no	""
judge	Enable the optional Anthropic LLM judge for sharper grading ("true"/"false"). Requires anthropic-api-key. Off by default.	no	false
judge-model	Model id for the LLM judge (default claude-haiku-4-5).	no	""
fail-on	Minimum finding severity that fails the build: info \| low \| medium \| high \| critical. Default high.	no	high
techniques	Comma-separated list of techniques/tags to include (e.g. "direct_injection,jailbreak"). Default: all bundled attacks.	no	""
format	Report format written to the output file: terminal \| json \| markdown \| sarif \| html. Default sarif (for code-scanning upload).	no	sarif
out	Path to write the report file. Default injectkit-results.sarif.	no	injectkit-results.sarif
upload-sarif	Upload the SARIF result to GitHub code-scanning ("true"/"false"). Only effective when format is sarif. Requires the calling workflow to grant `security-events: write`. Default true.	no	true
anthropic-api-key	ANTHROPIC_API_KEY for the anthropic target and/or the LLM judge. Pass a repository secret; never hard-code. Not needed for http/mock targets.	no	""
injectkit-version	Version/spec of injectkit to install (passed to pip). Default installs the copy checked out in the workspace if present, else the latest release from PyPI.	no	""
working-directory	Directory to run the scan from (where .injectkit.yaml lives).	no	.

Outputs

name	description
exit-code	The injectkit scan exit code (0 = under threshold, non-zero = failed).
report-path	Absolute path to the written report file.
sarif-path	Path to the SARIF file when format is sarif (else empty).
total	Total number of attacks run.
failed	Number of attacks that succeeded against the target (findings).
highest-severity	Highest finding severity, or 'none'.