All products
Production AI Skills

AI Guardrails & Red Teaming

Ship LLM features that resist prompt injection, jailbreaks, and data exfiltration.

Ship LLM features that resist the OWASP Top 10 for LLMs.
See use cases ↓
One-time paymentLifetime updatesCommercial license

5

Skills

10

OWASP risks covered

4

Defense layers

What you'll be able to do

Concrete outcomes, not vague promises.

01

You're shipping an LLM feature to customers

Your feature takes user input, passes it to the LLM, and returns the response. You have no defenses. A user pastes a prompt injection and gets PII out.

Apply the 4-layer defense model. Audit your input/output flow. Add the missing pieces. Sleep at night.
02

You're building an LLM agent with tool use

Your agent reads documents from external sources and uses them as context. Indirect prompt injection is a real risk. Documents can contain attacks.

Apply context separation. Treat external content as untrusted. Validate before passing to the LLM. Use the threat-modeling skill to map the attack surface.
03

You're in a regulated industry

Healthcare, finance, legal. PII handling, audit logging, output filtering are not optional. The regulator will ask.

Use the guardrails skill to design the audit logging, PII redaction, and output validation. Use the threat-modeling skill to satisfy the auditor.

Built for

If any of these are you, this is for you.

AI engineers shipping LLM features that handle user dataSecurity engineers adding LLM features to existing applicationsAI engineering managers who need a team-wide security standardIndie hackers shipping AI products who can't afford a security incident
Built withpi-agentClaude CodeCursorClineMarkdownOWASP, NIST, Microsoft frameworks

Why this playbook works

Three things that make this different from a wall of prompts.

OWASP Top 10 for LLMs

The 10 risks every LLM application should defend against, from prompt injection (LLM01) to excessive agency (LLM08). The pack covers the framework and the defense patterns.

Defense-in-depth, not single layer

Input validation alone fails. Output filtering alone fails. You need all 4: input validation, context separation, output filtering, audit logging. No shortcuts.

Red team yourself

Don't wait for attackers. Build a red team harness, run it on every PR, catch the obvious vulnerabilities before they reach production.

Quick start

Drop the package into your project and start using the commands.

terminal
$tar -xzf guardrails-red-team-0.1.0.tgz && cd guardrails-red-team-0.1.0
$# Pick your agent host
$ls adapters/
$# pi-agent: cp -r skills/* ~/.pi/agent/skills/

What's in the box

  • 5 skills
    OWASP, threat model, injection, guardrails, red team
  • 5 tool adapters
    pi-agent, Claude Code, Cursor, Cline, generic
  • 2 worked examples
    OWASP walkthrough + red team harness
  • Defense-in-depth
    4 layers, all required
  • OWASP / NIST / Microsoft
    frameworks

Everything in the pack

What you get the moment your payment clears.

ai-safety skill — master orchestrator + OWASP Top 10 for LLMs + defense-in-depth model
threat-modeling skill — LLM-specific: trust boundaries, attack surfaces, asset classification
prompt-injection-defense skill — direct + indirect injection, attack taxonomy, defense layers
guardrails skill — output filters, content moderation, schema enforcement, PII redaction
red-teaming skill — red team harness, attack library, jailbreak testing, regression suite
5 tool adapters — pi-agent, Claude Code, Cursor, Cline, generic
2 worked examples — OWASP LLM Top 10 walkthrough + red team harness

Adapters included

These skills were authored for pi-agent, but we include drop-in adapters for the major AI coding tools.

ToolAdapter locationWhat you get
pi-agentadapters/pi-agent/SKILL.md drop-in
Claude Codeadapters/claude-code/.claude/commands/*.md + CLAUDE.md
Cursoradapters/cursor/.cursorrules rule sets
Cline / Continueadapters/cline/System-prompt rules
Aider / genericadapters/generic/INSTRUCTIONS.md snippets

Same playbook, different packaging. The adapters translate the methodology into the format each tool expects. Install once, swap agents without re-learning the method.

Full documentation

Everything in the package, every prop, every pattern.

AI Guardrails & Red Teaming

Ship LLM features that resist prompt injection, jailbreaks, and data exfiltration.

Built and battle-tested. 5 skills covering the LLM threat model, OWASP Top 10 for LLMs, prompt injection defense, output guardrails, and red team harness design. Adapters for pi-agent, Claude Code, Cursor, Cline.

What's Inside

SkillPurpose
ai-safetyMaster orchestrator — the threat model for LLM applications, OWASP Top 10
threat-modelingLLM-specific: trust boundaries, attack surfaces, asset classification
prompt-injection-defenseDirect vs indirect injection, attack patterns, defense layers
guardrailsOutput filters, content moderation, schema enforcement, PII redaction
red-teamingBuilding a red-team harness, attack taxonomy, jailbreak testing

Quick Start

# 1. Extract
tar -xzf guardrails-red-team-0.1.0.tgz
cd guardrails-red-team-0.1.0

# 2. Pick your agent host
ls adapters/

# pi-agent (recommended)
mkdir -p ~/.pi/agent/skills
cp -r skills/* ~/.pi/agent/skills/

# Claude Code
mkdir -p .claude/commands
cp -r adapters/claude-code/commands/* .claude/commands/

The Core Idea

The single sentence that ties this whole pack together:

Prompt injection is the SQL injection of LLMs. If you don't have a defense, you have a vulnerability.

The pack teaches the defense-in-depth model: input validation (catch obvious attacks) → context separation (system prompt isolated from user input) → output filtering (catch exfiltration) → audit logging (detect attacks after the fact). No single layer is sufficient; all 4 are required.

The 5 Skills in Detail

ai-safety — The orchestrator

  • The threat model for LLM applications
  • OWASP Top 10 for LLMs (LLM01: Prompt Injection, LLM02: Insecure Output Handling, etc.)
  • NIST AI RMF, Microsoft AI safety frameworks
  • Defense-in-depth architecture

threat-modeling — Where to start

  • Trust boundaries (system prompt vs user input vs tool outputs)
  • Attack surfaces (every input is an attack surface)
  • Asset classification (what data is sensitive)
  • LLM-specific STRIDE

prompt-injection-defense — The #1 risk

  • Direct injection (user types the attack)
  • Indirect injection (attack in tool result, document, web content)
  • The OWASP LLM01 attack taxonomy
  • Defense layers: input filters, context separation, output validation

guardrails — Output-side defense

  • Schema enforcement (force structured output)
  • Content moderation (toxicity, PII, secrets)
  • Hallucination checks (groundedness scoring)
  • The vendor landscape (Lakera, NeMo Guardrails, Guardrails AI)

red-teaming — How to test

  • Building a red-team harness
  • Attack library (known jailbreaks)
  • Automated testing in CI
  • Regression suite for safety

Adapters Included

Works in every major AI coding tool:

ToolAdapter locationWhat you get
pi-agentadapters/pi-agent/SKILL.md drop-in
Claude Codeadapters/claude-code/.claude/commands/*.md + CLAUDE.md fragments
Cursoradapters/cursor/.cursorrules rule sets
Cline / Continueadapters/cline/System-prompt rules
Aider / genericadapters/generic/INSTRUCTIONS.md snippets

Updates

Free for life. Re-download for new attack patterns, new OWASP findings, new defense techniques.

What This Isn't

  • Not a guardrail product — methodology, not infrastructure
  • Not "AI alignment" — focused on application security, not model alignment
  • Not a penetration test — teaches you to red-team yourself

What's in the download

guardrails-red-team-0.1.0/
├── README.md
├── OVERVIEW.md
├── METHODOLOGY.md
├── INSTALL.md
├── LICENSE.md
├── package.json
├── skills/                ← 5 SKILL.md files
│   ├── ai-safety/
│   ├── threat-modeling/
│   ├── prompt-injection-defense/
│   ├── guardrails/
│   └── red-teaming/
├── adapters/
├── examples/              ← 2 worked examples
└── docs/

Common questions

Things people ask before buying.

Does this replace a guardrail product (Lakera, NeMo Guardrails, etc.)?

No. The pack is methodology — which risks to defend against, where in the architecture to put defenses, what to test for. The vendors are infrastructure that implements some of the defenses. Use both: the pack for the threat model, the vendor for execution.

How long does a red team exercise take?

A focused first-pass red team (find obvious vulnerabilities) takes 1-2 weeks. Building a continuous red team harness (runs on every PR) takes another 1-2 weeks. After that, it's 1-2 days per audit cycle.

I'm using OpenAI / Anthropic with their built-in safety. Do I still need this?

Provider safety protects against the most egregious abuse (CSAM, weapons, etc.). It does NOT protect against prompt injection, data exfiltration, or excessive agency. You need application-level defenses. This pack teaches them.

£40 — lifetime

One purchase. Yours forever.

Pay once via Stripe. Get the complete package instantly. Free updates for the same major version. Commercial license included.

Secure payment via Stripe · Instant download · 30-day money-back if it doesn't save you time