How to use the AI Security Hardening agent skill

What the skill makes the agent do

Once installed, the agent has access to a reference guide for hardening LLM deployments. The guide lays out a threat model that maps each AI-specific threat to a risk and a control: prompt injection leads to system prompt override and is addressed with input sanitization and separate context; data exfiltration leads to PII in model outputs and is addressed with output filtering and DLP scanning; model theft leads to weight extraction via API and is addressed with rate limiting and access controls.

The skill also includes example code for input checks, output PII scrubbing with Presidio, NeMo Guardrails configuration, and token and rate-limit patterns for LLM API endpoints. The guide is explicit that regex-based detection is not a real security boundary, so the agent should present the examples as illustrations, not as proof that an input or output is safe.

• Threat model table covering prompt injection, data exfiltration, jailbreaking, model theft, training data poisoning, supply chain attacks and insecure output
• Input checks using regex indicators and length and control-character cleanup
• Output PII scrubbing using Presidio analyzer and anonymizer
• NeMo Guardrails config with input and output flows
• FastAPI example with bearer token verification and per-key rate limiting

Install the skill from the ZIP download

Download the ZIP for this skill from the directory page. Unzip it into your personal skills folder, ~/.claude/skills/, so it is available across your projects. If you only want it for one codebase, unzip it into that project's .claude/skills/ folder instead.

If you use the Claude apps rather than a local setup, you can upload the skill under Settings → Capabilities → Skills. The skill folder includes a SKILL.md file, which is the only file in this package.

• Personal install: ~/.claude/skills/
• Project install: the .claude/skills/ folder inside your project
• Claude apps: Settings → Capabilities → Skills, then upload the skill

Trigger the skill with natural requests

You do not need a special command. Describe the task in plain language and mention the security concern. The skill's own description covers hardening AI and LLM deployments against prompt injection, data exfiltration, model theft and supply chain attacks, and its use cases include deploying an LLM app that handles sensitive user data, protecting AI agents from prompt injection, adding output filtering, and preparing SOC2 or ISO 27001 evidence for AI features.

Good requests name the system and the goal. Vague requests such as 'make my AI secure' give the agent little to work with.

• Review my chatbot's FastAPI endpoint for prompt injection and rate-limit gaps.
• Add PII scrubbing to the output of my LLM summarizer using Presidio.
• Draft a NeMo Guardrails config that checks input for jailbreaks and output for PII.
• List the controls I should document for SOC2 evidence on our AI feature.

Example: scrubbing PII from model output

The skill's output filtering section uses Presidio to find and anonymize personal data before a response reaches the user. The entity list below comes from the skill's example and covers names, email addresses, phone numbers, card numbers, US social security numbers, IBAN codes, IP addresses and locations.

Check the entity list against the data your application actually handles. The example only covers the entities listed, and it is written for English text.

What you need before using the examples

The examples need a Python environment. Some are optional: NeMo Guardrails, Microsoft Presidio, FastAPI and PyJWT are the libraries the snippets import. If you use the NeMo example, you also need an LLM provider API key; the skill's config references OpenAI with the gpt-4o-mini model.

The skill's compatibility note says it requires the relevant security tooling, such as scanners or vault CLIs, and an authorized scope for any active assessment. Helper scripts and templates are not bundled, and the skill runs no scripts and makes no network calls itself.

• Python environment for the example code
• Optional libraries: NeMo Guardrails, Microsoft Presidio, FastAPI, PyJWT
• An LLM provider API key if you use the NeMo example
• Security scanners or vault CLIs, if your assessment needs them

Safety notes on scripts, network and enforcement

The skill itself does not run scripts and does not use the network. That does not make the code it suggests safe to deploy. The API example's secret, issuer and audience values, the call_llm function and other project functions are undefined in the guide; you have to supply them, and the rate limiter is an in-process map that the guide says is not a distributed limiter.

Real enforcement has to be server-side. The guide says to enforce tool and data authorization independently of model text, give the model access only to the secrets it needs, and require approval for scoped side effects. Treat any output from the agent as a draft that a qualified engineer reviews before production.

• Bind secret keys and token issuer or audience to a verified trusted configuration
• Require explicit scopes and tenant authorization before any model or tool call
• Use a shared rate limiter for multi-worker production
• Validate the full request schema and size before reading messages