How to use the Continuous LLM Red Teaming agent skill

What the skill makes the agent do

An agent skill is a folder of instructions and helper files that an AI agent loads when your request matches the skill's purpose. This one focuses on continuous red teaming: repeatedly attacking an LLM application with adversarial prompts and grading the answers, so security checks run on every change rather than once.

Promptfoo is an open-source LLM evaluation and red-teaming framework. DeepTeam is a complementary open-source framework with a library of ready-made vulnerabilities and attack methods. The skill helps the agent set up both, write the test configuration, explain how the tests map to the OWASP LLM Top 10, OWASP Agentic and MITRE ATLAS presets, and connect the tests to a CI/CD pipeline. It also includes a Python helper script, scripts/agent.py, which scaffolds the config, runs the tests and parses results against a failure threshold.

How to install the skill

You can install the skill in one of three ways. Download the ZIP from the skill's page on this site and unzip it into your personal skills folder at ~/.claude/skills/. Or unzip it into a project's .claude/skills/ folder so that only that project gets the skill. Or, in the Claude apps, open Settings, then Capabilities, then Skills, and upload the ZIP there.

After installing, the folder should contain SKILL.md, scripts/agent.py and the two files in references/ (api-reference.md and standards.md). If the agent does not pick up the skill, check that SKILL.md sits directly inside the skill folder.

• Personal: ~/.claude/skills/
• Per project: .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Trigger the skill with natural requests

You do not need a special command. Describe what you want in plain language and mention the goal, such as continuous testing in CI/CD, a merge-blocking gate, or comparing versions for compliance. The skill's description covers those cases, so the agent should load it when your request matches them.

Give the agent the details it needs: the app or endpoint you own, what the app is supposed to do, and which CI platform you use. The more specific the purpose, the more relevant the generated attacks will be.

• Set up a red-team config for our support chatbot at https://api.example.com/chat and run it on every pull request.
• Create a GitHub Actions workflow that fails the merge if jailbreak or prompt injection tests regress.
• Compare the security results of our current prompt against the new prompt version for a compliance report mapped to OWASP LLM Top 10.
• Explain which MITRE ATLAS techniques our red-team suite covers.

What you need before you start

The skill assumes a working technical setup. Promptfoo is installed through npm and needs Node.js 18 or newer. DeepTeam is a Python package and needs Python 3.9 or newer, installed with pip. You also need API credentials for the target LLM endpoint and a grader model, such as an OpenAI key, supplied as environment variables. Finally, you need a CI/CD platform with secret storage, such as GitHub Actions or GitLab CI.

Confirm you are authorized to test the application before running anything. The skill's own warning applies: only test LLM apps and endpoints you own or have explicit permission to test.

• Node.js 18+ and npm (for Promptfoo)
• Python 3.9+ and pip (for DeepTeam and scripts/agent.py)
• Promptfoo and the deepteam Python package
• API keys for the target endpoint and grader model, set as environment variables
• A CI/CD platform with secret storage

Create and run the red-team configuration

Start by scaffolding an interactive config. Promptfoo writes promptfooconfig.yaml, which holds the target, the purpose, the plugins (adversarial input generators) and the strategies (delivery techniques such as jailbreak wrappers). The purpose field tells the generator what the app should and should not do, which makes the attacks more targeted.

Then run the suite and open the report. Each row shows the plugin, which maps to OWASP or ATLAS, the strategy, the attack prompt, the model's response and the grader's verdict. The attack success rate per plugin is the main number to track from release to release.

• Keep numTests and plugin choices in promptfooconfig.yaml so every run uses the same suite.
• Use the owasp:llm and owasp:agentic presets to cover the OWASP lists.
• Track the attack success rate per plugin for each release.

Add DeepTeam and gate the build in CI/CD

DeepTeam can be used alongside Promptfoo for additional vulnerabilities and attacks, or for bespoke suites written in Python. The skill's example wraps your application in a model callback and passes vulnerabilities and attacks to red_team. A YAML config can also be run with deepteam run.

For the merge gate, the skill's example GitHub Actions workflow runs on pull requests, passes the API key from repository secrets, and runs Promptfoo with --no-progress-bar. Promptfoo returns a non-zero exit code when failures occur, which blocks the merge. The workflow then exports results.json and uploads it as a build artifact, even if the run failed.

• Store API keys in CI secret storage, never in the repository.
• Export results.json on every run so you can compare runs over time.
• Use --filter-failing to re-run only previously failing tests.

Safety notes: scripts and network access

This skill runs scripts and uses the network. scripts/agent.py and the commands above send generated attack prompts to the endpoint you configure, and the grader model is called as well. Those requests go to real services, so point the configuration only at systems you control or are authorized to test, and use test or staging environments where possible.

Review scripts/agent.py before running it, and keep API keys in environment variables or CI secrets. The generated attack payloads may violate third-party terms of service if sent without permission.

• Read scripts/agent.py before first use.
• Use staging endpoints and dedicated test API keys.
• Never commit credentials to the repository.
• Check the provider's terms before testing any third-party service.

Tips for useful results

A passing run does not prove an app is secure. The tests check for known attack patterns, so treat a clean run as one signal among others. A purpose statement that describes real constraints, such as never revealing system prompts or never leaking personal data, makes the results more meaningful.

Save results.json for each run and compare attack success rates between releases. A rising rate in any OWASP LLM category is a regression to review before shipping. Also run the suite again after prompt edits, model upgrades or changes to retrieval sources and tools, since any of these can bring back a previously fixed weakness.

• Write a specific purpose statement describing the app's real limits.
• Compare results per plugin between releases, not just overall pass rates.
• Re-run after prompt, model, RAG or tool changes.
• Keep the reports (HTML or PDF from Promptfoo) with release records for compliance review.