# AI Guardrails & Red Teaming

> [View this product on lib-pro](https://lib-pro-3f8437.gitlab.io/libs/guardrails-red-team) · Ship LLM features that resist prompt injection, jailbreaks, and data exfiltration.

**Outcome:** Ship LLM features that resist the OWASP Top 10 for LLMs.

5 skills for shipping LLM features that are safe in production: the OWASP Top 10 for LLMs as the framework, threat modeling, prompt injection defense (direct + indirect), output guardrails, and red team harness design. The Microsoft + OWASP + NIST AI safety frameworks, packaged as a SKILL.md bundle.

**Price:** £40 — lifetime · **Category:** Production AI Skills · **Tech:** pi-agent, Claude Code, Cursor, Cline, Markdown, OWASP, NIST, Microsoft frameworks

| Metric | Value |
|--------|-------|
| Skills | 5 |
| OWASP risks covered | 10 |
| Defense layers | 4 |

## Quick start

```bash
tar -xzf guardrails-red-team-0.1.0.tgz && cd guardrails-red-team-0.1.0
```

- # Pick your agent host
- ls adapters/
- # pi-agent: cp -r skills/* ~/.pi/agent/skills/

## Code preview

```
# ai-safety — The LLM Threat Model

Prompt injection is the SQL injection of LLMs. If you don't have a defense, you have a vulnerability.

## The OWASP Top 10 for LLMs

- LLM01: Prompt Injection
- LLM02: Insecure Output Handling
- LLM03: Training Data Poisoning
- LLM04: Model DoS
- LLM05: Supply Chain Vulnerabilities
- LLM06: Sensitive Information Disclosure
- LLM07: Insecure Plugin Design
- LLM08: Excessive Agency
- LLM09: Overreliance
- LLM10: Model Theft

The pack teaches defense patterns for each. LLM01 (Prompt Injection) and LLM08 (Excessive Agency) are the most common production risks.

## The Defense-in-Depth Model

1. **Input validation** (catch obvious attacks before they reach the LLM)
2. **Context separation** (system prompt isolated from user input + tool results)
3. **Output filtering** (catch exfiltration attempts in responses)
4. **Audit logging** (detect attacks after the fact)
5. **Red team testing** (find vulnerabilities before attackers do)

No single layer is sufficient. All 4 are required.
```

## Use cases

### 1. You're shipping an LLM feature to customers

Your feature takes user input, passes it to the LLM, and returns the response. You have no defenses. A user pastes a prompt injection and gets PII out.

**Outcome:** Apply the 4-layer defense model. Audit your input/output flow. Add the missing pieces. Sleep at night.

### 2. You're building an LLM agent with tool use

Your agent reads documents from external sources and uses them as context. Indirect prompt injection is a real risk. Documents can contain attacks.

**Outcome:** Apply context separation. Treat external content as untrusted. Validate before passing to the LLM. Use the threat-modeling skill to map the attack surface.

### 3. You're in a regulated industry

Healthcare, finance, legal. PII handling, audit logging, output filtering are not optional. The regulator will ask.

**Outcome:** Use the guardrails skill to design the audit logging, PII redaction, and output validation. Use the threat-modeling skill to satisfy the auditor.

## Built for

- AI engineers shipping LLM features that handle user data
- Security engineers adding LLM features to existing applications
- AI engineering managers who need a team-wide security standard
- Indie hackers shipping AI products who can't afford a security incident

## Highlights

### OWASP Top 10 for LLMs

The 10 risks every LLM application should defend against, from prompt injection (LLM01) to excessive agency (LLM08). The pack covers the framework and the defense patterns.

### Defense-in-depth, not single layer

Input validation alone fails. Output filtering alone fails. You need all 4: input validation, context separation, output filtering, audit logging. No shortcuts.

### Red team yourself

Don't wait for attackers. Build a red team harness, run it on every PR, catch the obvious vulnerabilities before they reach production.

## What's in the box

- `5 skills` — OWASP, threat model, injection, guardrails, red team
- `5 tool adapters` — pi-agent, Claude Code, Cursor, Cline, generic
- `2 worked examples` — OWASP walkthrough + red team harness
- `Defense-in-depth` — 4 layers, all required
- `OWASP / NIST / Microsoft` — frameworks

## Adapters included

These skills were authored for pi-agent, but we include drop-in adapters for the major AI coding tools.

| Tool | Adapter location | What you get |
|------|------------------|--------------|
| pi-agent | `adapters/pi-agent/` | SKILL.md drop-in |
| Claude Code | `adapters/claude-code/` | .claude/commands/*.md + CLAUDE.md |
| Cursor | `adapters/cursor/` | .cursorrules rule sets |
| Cline / Continue | `adapters/cline/` | System-prompt rules |
| Aider / generic | `adapters/generic/` | INSTRUCTIONS.md snippets |

**Same playbook, different packaging.** The adapters translate the methodology into the format each tool expects. Install once, swap agents without re-learning the method.

## Features

- ai-safety skill — master orchestrator + OWASP Top 10 for LLMs + defense-in-depth model
- threat-modeling skill — LLM-specific: trust boundaries, attack surfaces, asset classification
- prompt-injection-defense skill — direct + indirect injection, attack taxonomy, defense layers
- guardrails skill — output filters, content moderation, schema enforcement, PII redaction
- red-teaming skill — red team harness, attack library, jailbreak testing, regression suite
- 5 tool adapters — pi-agent, Claude Code, Cursor, Cline, generic
- 2 worked examples — OWASP LLM Top 10 walkthrough + red team harness

## FAQ

### Does this replace a guardrail product (Lakera, NeMo Guardrails, etc.)?

No. The pack is methodology — which risks to defend against, where in the architecture to put defenses, what to test for. The vendors are infrastructure that implements some of the defenses. Use both: the pack for the threat model, the vendor for execution.

### How long does a red team exercise take?

A focused first-pass red team (find obvious vulnerabilities) takes 1-2 weeks. Building a continuous red team harness (runs on every PR) takes another 1-2 weeks. After that, it's 1-2 days per audit cycle.

### I'm using OpenAI / Anthropic with their built-in safety. Do I still need this?

Provider safety protects against the most egregious abuse (CSAM, weapons, etc.). It does NOT protect against prompt injection, data exfiltration, or excessive agency. You need application-level defenses. This pack teaches them.