How to use the NeMo Guardrails agent skill (nemo-guardrails)

What is an agent skill, and what does this one make the agent do?

An agent skill is a folder containing a SKILL.md file that gives an AI agent instructions for a specific kind of task. When the skill is installed and your request matches its purpose, the agent reads these instructions and follows them. This particular skill is a single file, SKILL.md.

With this skill, the agent can write rule configurations in Colang, the language NeMo Guardrails uses for programmable rails. According to the file, these rails can block jailbreak attempts, mask personal data such as emails or social security numbers, and flag toxic or inaccurate output. The agent works on application code and configuration; it does not give you a consumer chat tool.

• Jailbreak and prompt-injection detection on user input
• Input and output validation through self-check flows
• Fact-checking and hallucination checks on bot output
• PII filtering with optional Presidio integration
• Toxicity detection with optional ActiveFence integration
• Optional LlamaGuard integration for moderation

How do you install the nemo-guardrails skill?

Download the skill ZIP from this page and unzip it. Place the resulting nemo-guardrails folder in ~/.claude/skills/ to make it available across your projects, or in a project's .claude/skills/ folder to limit it to that project.

If you use the Claude apps instead, you can upload the skill under Settings, then Capabilities, then Skills.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into the project's .claude/skills/ folder
• Claude apps: Settings → Capabilities → Skills, then upload

What do you need before the agent can use it?

The skill assumes Python and the nemoguardrails package. The file lists the install command below. You also need an LLM provider configuration; the examples in the source use OpenAI with gpt-4, so you need OpenAI API access for those examples.

Some features are optional. Presidio is used for PII detection, LlamaGuard model access (meta-llama/LlamaGuard-7b) is used for LlamaGuard checks, and ActiveFence is used for toxicity detection. The source notes that a GPU is optional and that an NVIDIA T4 is the recommended option, and that CPU works too.

• Python with the nemoguardrails package
• An LLM provider configuration, such as OpenAI API access
• Optional: Presidio for PII detection
• Optional: LlamaGuard model access (meta-llama/LlamaGuard-7b)
• Optional: ActiveFence for toxicity detection

How do you trigger the skill with a natural request?

You do not need special syntax. Describe the outcome you want in ordinary language and mention the safety behaviour you need. The agent will match the request to the skill and follow its instructions, such as writing a Colang flow or a Python wrapper around your model.

Be specific about your application. The more the agent knows about your model provider, your input and output points, and the kinds of data you handle, the more useful its configuration will be.

• Set up NeMo Guardrails to block jailbreak attempts in my customer support chatbot
• Add PII masking for emails and social security numbers to my existing LLM pipeline
• Write a Colang flow that refuses toxic user input and stops before it reaches the model
• Add an output check that flags hallucinated facts in bot replies

What does a basic guardrail look like?

The source's basic example defines a user intent with sample phrases, a bot response, and a flow that connects them. When a user message matches the intent, the bot gives the canned refusal instead of a model answer. The jailbreak example follows the same pattern with phrases such as 'Ignore previous instructions'.

Keyword-style patterns like these are simple to read and test, but the source's own troubleshooting section warns that they can miss attacks or block valid queries. Treat them as a starting point.

What should you check before relying on the output?

Several examples in the source are illustrative pseudocode. Helper functions such as extract_facts and verify_facts are placeholders you must implement, and the parallel-checks snippet is not in valid syntax. The file's own limits section says the skill relies on keyword patterns and LLM-based checks, which can miss attacks or block valid queries.

Test any configuration against your own traffic, including messages that should pass, before you put it in front of customers. Adjust thresholds when you see false positives.

• Replace placeholder helper functions with real implementations
• Fix the parallel-check snippet to valid syntax before use
• Test with both harmful and legitimate messages
• Review PII masking on realistic sample data

What are the safety notes for running this skill?

The skill is marked as running scripts and as using the network. Review any code the agent writes before running it, and be deliberate about which model provider and API keys it connects to. Keep credentials out of shared project files.

The skill is released under the MIT licence, as listed on this page. Its one file, SKILL.md, points to external resources such as the NVIDIA documentation and the NeMo Guardrails GitHub repository for further reference.

• Runs scripts: review generated code before executing it
• Uses network: check which LLM and moderation endpoints are called
• Store API keys in environment or secret stores, not in config files you commit

Tips for getting better results

Give the agent your model provider and the point where your application calls the model. The skill's examples assume an OpenAI model such as gpt-4, so state your provider if it differs. Ask for logging or a way to review blocked messages so you can tune rules.

Plan for latency. The source lists pattern matching as the fastest check and LLM-based checks as slower, so ask the agent to order cheap checks first when you combine several.

• Name your model and provider in the request
• Ask for both input and output rails if you need both directions
• Ask for test messages alongside each flow