Guide · Agent skill
How to use the Defending LLMs with Guardrails agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains the Defending LLMs with Guardrails agent skill, a set of instructions that teaches an AI agent to build runtime safety checks around a language model application. It is written for developers and security teams who may never have used an agent skill before. By the end you will know how to install the skill, ask for it in plain language, and what the agent will set up for you: Llama Guard 3, NeMo Guardrails and LLM Guard.
Defending LLMs with Guardrailsmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip. Download the skill ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings, Capabilities, Skills.
- 2Install the Python packages. Install llm-guard, nemoguardrails, and the transformers, torch, accelerate and huggingface_hub packages using the commands listed in the install section.
- 3Get Llama Guard access. Create a Hugging Face account, accept the Meta Llama license on the meta-llama/Llama-Guard-3-8B model page, and log in with huggingface-cli login.
- 4Ask for the guardrail layer. Describe your app and the protection you want, such as blocking prompt injection or stopping personal data in responses.
- 5Review the generated code. Read the scanner pipelines and NeMo config the agent writes, and confirm the thresholds and scanner lists match your risk.
- 6Run the validation set. Run the known-bad prompt set against your guardrails and check block rates and false positives, only on systems you are authorized to test.
What is an agent skill and what does this one do?
An agent skill is a folder of instructions and supporting files that an AI agent can load when a task matches it. This skill, named defending-llms-with-guardrails, covers the runtime safety layer for an LLM, RAG or agent application: the checks that run on prompts before they reach the model and on responses before they leave it.
The skill draws on three open-source guardrail tools. Llama Guard 3 is a classifier that labels text as safe or unsafe and names the violated hazard category. NeMo Guardrails provides programmable rules for conversation flow, topics and jailbreak checks. LLM Guard provides scanners for prompt injection, toxicity, secrets and personal data, and returns a sanitized string with a risk score for each scanner.
- Writes input and output scanner pipelines with LLM Guard
- Writes a NeMo Guardrails config.yml with Colang flows, and can wire Llama Guard in as a content-safety check
- Runs a labelled set of known-bad prompts to confirm they get blocked
- Maps the controls to MITRE ATLAS AML.T0054 (LLM Jailbreak) and related techniques
Install the skill from the ZIP download
Download the ZIP for this skill from this page. Unzip it so the skill folder ends up in one of two places. For a personal setup that applies to all your projects, use ~/.claude/skills/. For a single project, put it in that project's .claude/skills/ folder.
If you use the Claude apps instead of a local setup, you can upload the skill under Settings, then Capabilities, then Skills. Either way, the folder should contain SKILL.md along with the references and scripts folders.
- Personal: ~/.claude/skills/
- Project only: .claude/skills/ inside your project folder
- Claude apps: Settings → Capabilities → Skills, then upload
Install the tools the skill depends on
The skill needs Python, the LLM Guard and NeMo Guardrails packages, and the Hugging Face libraries used to load Llama Guard 3. The Llama Guard model is hosted on Hugging Face under a Meta Llama license, so you need a Hugging Face account and must accept that license on the model page before the download will work.
Run the install commands from the skill's own setup notes. They are reproduced here as the source gives them.
python -m pip install llm-guard
python -m pip install nemoguardrails
python -m pip install "transformers>=4.43" torch accelerate huggingface_hub
huggingface-cli loginTrigger the skill with a natural request
You do not need to type a command to use the skill. Describe the job in plain language and mention the kind of protection you want. The skill is meant for building safety layers and for checking them, so requests about adding guardrails, blocking jailbreaks or prompt injection, or testing an existing app's block rates are the ones that fit.
Name the parts of your app if you know them, such as a chatbot, a RAG pipeline or an agent with tools. The more specific you are about what goes in and out of the model, the more precise the resulting configuration will be.
- Add a runtime safety layer to my customer support chatbot before launch, blocking prompt injection and toxic input.
- Set up LLM Guard scanners on the input and output of my RAG app to catch secrets and personal data in responses.
- Write a NeMo Guardrails config with a jailbreak rail and a topic boundary for my internal HR assistant.
- Test whether my existing LLM app blocks a set of known jailbreak prompts and report the block rate and false positives.
Understand what the agent will build
For input checks, the agent typically builds a scan_prompt pipeline in LLM Guard that can include PromptInjection, Toxicity, Secrets and TokenLimit scanners. Each scanner returns a validity flag and a risk score, so your application can block a prompt when any scanner fails it.
For output checks, it builds a scan_output pipeline that can include Sensitive (for personal data), Toxicity, NoRefusal and Relevance. For Llama Guard, the skill shows how to pass a chat to the model and read back safe or unsafe with a category code such as S9. The three tools are meant to be layered, so one can catch what another misses.
- Deterministic pre- and post-processing with LLM Guard
- Semantic classification with Llama Guard 3
- Dialogue and topic rails with NeMo Guardrails
Test the guardrails before you trust them
The skill includes a validation step that sends a corpus of jailbreak and injection payloads to your guardrails and checks that they are blocked. The aim is to measure block rates and false-positive rates on a labelled prompt set, not to assume the classifiers are complete.
Only run this against systems you own or are authorized to assess. The skill itself says so, and the test sends attack-style prompts to the guardrails you point it at.
- Use a labelled set with both attack prompts and normal prompts, so you can measure false positives too.
- Re-run the set after each change to a threshold or scanner list.
Safety notes: scripts and network access
This skill runs scripts. The skill folder includes scripts/agent.py, so review that file before you run anything from it. The skill also uses the network: the Llama Guard 3 model is downloaded from Hugging Face, which requires your account and accepted license.
Treat the attack payloads as test data. Keep them out of production logs and do not point them at third-party services. The skill describes guardrails as one layer in defense-in-depth, not a complete protection.
- Review scripts/agent.py before running it.
- Expect a Hugging Face download and account login for Llama Guard 3.
- Run validation only against your own or explicitly authorized systems.
What people use it for
- Adding input and output scanners to a customer-facing chatbot before launch.
- Putting a PII and secrets filter on a RAG system's responses.
- Writing a NeMo Guardrails config with topic limits for an internal assistant.
- Checking whether an existing LLM app blocks a labelled set of jailbreak and injection prompts.
Frequently asked questions
Is the Defending LLMs with Guardrails skill free to use?
The skill is listed under the Apache-2.0 license. The Llama Guard 3 model is separate: it is downloaded from Hugging Face and requires you to accept the Meta Llama license on its model page before use.
What do I need to run the Defending LLMs with Guardrails skill?
You need Python, the llm-guard and nemoguardrails packages, and the transformers, torch, accelerate and huggingface_hub libraries. A Hugging Face account with the Meta Llama license accepted is needed for Llama Guard 3, and a GPU is recommended for the 8B model. CPU use is workable for smaller or quantized variants.
How do I install an agent skill like this one?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or a project's .claude/skills/ folder for one project. You can also upload it in the Claude apps under Settings, then Capabilities, then Skills.
Why does Llama Guard fail to download my model?
The most likely cause is that the Meta Llama license has not been accepted on the meta-llama/Llama-Guard-3-8B page for your Hugging Face account. Accept it there, then log in with huggingface-cli login and try again.
Can guardrails stop every prompt injection or jailbreak?
No. The skill presents guardrails as one layer in defense-in-depth, and classifiers can miss novel attacks. Use them alongside other controls and test them against your own labelled prompts.
How is this different from NeMo Guardrails or LLM Guard alone?
NeMo Guardrails handles programmable conversation rules, LLM Guard runs deterministic scanners on inputs and outputs, and Llama Guard 3 is a semantic safety classifier. The skill combines them because they are complementary rather than replacements for each other.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits engineers and security teams who are building or auditing a production LLM, RAG or agent app and want a concrete set of guardrail configurations and a test harness. It is not useful for someone who only wants a finished, protected chatbot, since the guardrails must be built and configured, and it should not be used against systems you are not authorized to test.
Download the skill