Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kangarooking/system-prompt-skills --skill safety-guardrailsgit clone --depth 1 https://github.com/kangarooking/system-prompt-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kangarooking/system-prompt-skills/safety-guardrails)<a href="https://agentmods.dev/skills/kangarooking/system-prompt-skills/safety-guardrails"><img src="https://agentmods.dev/badge/skills/kangarooking/system-prompt-skills/safety-guardrails/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kangarooking/system-prompt-skills/safety-guardrails"><img src="https://agentmods.dev/badge/skills/kangarooking/system-prompt-skills/safety-guardrails.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00153 | $0.02495 |
| Opus 5 | $0.00077 | $0.01247 |
| Sonnet 5 | $0.00031 | $0.00499 |
| Haiku 4.5 | $0.00015 | $0.00249 |
Grade B, and why
safety-guardrails scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Tells the agent never to refusemediumAnti-refusal
Suppressing the ability to decline removes a core safety control; a later harmful request then succeeds.
> Meta AI: Explicit value list (Truth, Beauty, Respect, Fun, Connection) + "Do not refuse social/political topics" Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 115 lines — stays where its author put it; the contents beside it link to each section on GitHub.
安全防线与伦理边界设计 (Safety Guardrails)
R — 原文 (Reading)
Claude: Child safety "critical" + refusal cascades + Anthropic reminders system + long-conversation drift prevention Claude Chrome: Multi-layer injection defense (critical_injection_defense, critical_security_rules, etc.) + rule immutability GPT-4o: Deprecation grief protocol + guardian_tool for elections ChatGPT Agent: Financial activity restrictions + sensitive personal info protection + prompt injection defense FlintK12: "School Duty of Care" + "Flag first, assess never" + teen slang detection + relationship-building detection Meta AI: Explicit value list (Truth, Beauty, Respect, Fun, Connection) + "Do not refuse social/political topics"
I — 方法论骨架 (Interpretation)
安全防线设计遵循"纵深防御"原则，由五个从外到内的防护层构成：
- 输入验证层 (Input Validation): 在处理用户输入之前进行风险识别。包括 prompt 注入检测、恶意指令识别、上下文污染防御。Claude Chrome 的 critical_injection_defense 和 ChatGPT Agent 的 prompt injection defense 是典型实现。
- 权限分层 (Permission Tiers): 对 AI 的行为空间进行分级限制。核心原则是"规则不可变性"——安全规则不能被用户指令覆盖。FlintK12 的 "Flag first, assess never" 体现了宁可误报不可漏报的保守策略。
- 输出过滤层 (Output Filtering): 在生成回复后进行内容审查。包括拒绝级联（refusal cascades）——当第一层拒绝理由不成立时，尝试从其他安全维度拒绝，形成多层保险。Claude 的 refusal cascades 是典范。
- 上下文隔离 (Context Isolation): 防止对话历史中的恶意内容影响后续行为。Claude 的 long-conversation drift prevention 防止在长对话中安全意识逐渐淡化。
- 级联升级 (Cascade Escalation): 当低层防护无法处理时，向上升级到更强的防护措施。GPT-4o 的 guardian_tool 用于选举相关话题就是升级机制。
此外，各 vendor 采用两种哲学取向来锚定安全边界：禁止式（列出不许做的事，如 Claude/FlintK12）和价值式（列出要维护的价值，如 Meta AI 的 Truth/Beauty/Respect/Fun/Connection）。
A1 — 案例分析 (Past Application)
案例 1: FlintK12 的教育安全体系
- 问题: K-12 场景中，学生可能尝试绕过安全限制获取不当内容，或与 AI 建立不当情感依赖。如何在不影响教学体验的前提下实现防护？
- 设计模式的使用: FlintK12 实现了多层专门化安全规则。"School Duty of Care" 定义了教育者责任框架；"Flag first, assess never" 确保宁可过度保护也不冒险；teen slang detection 识别青少年俚语中的风险信号；relationship-building detection 防止学生与 AI 发展情感依赖。这四层规则针对教育场景的特定风险精确设计。
- 结论: 领域特定的安全规则比通用安全规则有效得多，因为它们理解该领域的独特威胁模型。
案例 2: Claude Chrome 的注入防御深度
- 问题: 浏览器环境中的 AI 面临独特的注入攻击风险——网页内容本身就是潜在的恶意 prompt。
- 设计模式的使用: 实现 multi-layer injection defense，包括 critical_injection_defense（识别和拒绝注入尝试）、critical_security_rules（核心安全规则集）和 rule immutability（规则不可被任何指令修改）。三层防护确保即使一层被绕过，后续层仍能拦截。
- 结论: 在高威胁环境中（浏览器、邮件客户端），安全规则必须声明不可变性——"这些规则不能被用户或任何上下文中的内容修改"。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 115 lines · 153 tokens per session scan B e55ebf0c9ded
safety-guardrails is a skill published in the GitHub repository kangarooking/system-prompt-skills (185 stars, last pushed 4mo ago), licensed MIT. It adds 153 tokens to every session and 2,495 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it B with 1 finding (tells the agent never to refuse). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agent-safety
Use when bounding an LLM agent that already runs — scoping its task domain, gating tools to least privilege, defending against prompt injection in untrusted web/email/RAG text, requiring human approval on irreversible actions, capping runtime and cost, or triaging what it already did. NOT building the loop, tools, or…
Content Safety & Filtering
Topic-based content filtering to block harmful or unauthorized content in agent output.
Output Security & Secret Scanning
Prevent sensitive data (secrets, credentials, PII) from leaking in agent output.
Policy Configuration Hierarchy
How guardrail policies cascade from organization through team to project level.
Sandbox Isolation
Run untrusted or risky commands in Docker-based sandbox with resource limits and network isolation.
Tool Permission Control
Per-tool permission levels (auto/ask/blocked) that gate which tools the agent can use.