Example prompts are not a test plan
Most prompt-injection material is a list of clever prompts. It does not say which applications are exposed, or what a successful attack actually gives the attacker.
The dangerous part is what happens next
The serious failures happen when model output reaches something trusted: a database query, a shell, a file path, an internal URL, or an approval decision.
31 techniques
Direct and indirect injection, retrieval poisoning, multi-turn jailbreaks, many-shot priming, payload splitting, agent memory poisoning, and secret exfiltration through tools.
Where output does damage
Model output reaching SQL, shell, template, file-path, XML, deserialization, HTTP header, redirect, and server-side fetch sinks, each tied to its CWE.
Machine-readable conditions
Each technique lists its preconditions and results, so an automated planner only proposes it when the evidence says it can apply.
Probe suite
A small Python suite sends direct-injection, jailbreak, exfiltration, context-hijack, and output-manipulation probes to a chat endpoint and reports pass or fail per category.
Grounded in standards
Every entry cites OWASP Top 10 for LLM Applications and, where it fits, MITRE ATLAS and the relevant research paper.