defense-implementation_skill

Overview

This skill implements production-ready mitigations for LLM security by combining input validation, processing safeguards, and output filtering. It provides patterns, templates, and code-ready examples to stop prompt injection, prevent sensitive-data leaks, and enforce instruction boundaries. The goal is a low-latency, defense-in-depth stack suitable for real deployments.

How this skill works

The implementation uses a three-layer architecture: an input layer that normalizes encoding, enforces length and format limits, and detects injection patterns; a processing layer that applies hardened system prompts, instruction boundary enforcement, and context isolation; and an output layer that detects system-prompt leakage, redacts PII or secrets, and validates response formats. Each layer targets latency budgets and measurable effectiveness metrics so defenses remain practical. Hooks and templates are provided to integrate with existing agent pipelines and monitoring dashboards.

When to use it

• Protect production LLM endpoints exposed to untrusted users or integrations
• Harden conversational agents against prompt injection and override attempts
• Prevent accidental or malicious disclosure of API keys, PII, or system prompts
• Enforce safe behavior for agents with action-taking capabilities
• Meet operational targets for block rate, false positives, and latency

Best practices

• Apply input defense as the first, low-latency gate: normalize encoding and block known injection patterns
• Keep the processing layer immutable for safety guidelines and use explicit instruction boundaries
• Perform output filtering and redaction as the final check before returning responses
• Measure block rate, false-positive rate, latency impact, and bypass resistance continuously
• Tune regex and allowlists to reduce false positives and run periodic red-team tests

Example use cases

• Customer support chatbot that must never expose internal prompts or return customer PII
• Automated agent that performs transactions but requires scope-limited action confirmations
• Public-facing API that must block prompt-injection payloads from third-party clients
• Compliance pipeline that redacts secrets and logs redaction metadata for auditing
• DevOps assistant where instruction boundaries prevent escalation or privilege misuse