Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add VoDaiLocz/kilo-kit-mcp --skill ai-guardrailsgit clone --depth 1 https://github.com/VoDaiLocz/kilo-kit-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vodailocz/kilo-kit-mcp/ai-guardrails)<a href="https://agentmods.dev/skills/vodailocz/kilo-kit-mcp/ai-guardrails"><img src="https://agentmods.dev/badge/skills/vodailocz/kilo-kit-mcp/ai-guardrails/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vodailocz/kilo-kit-mcp/ai-guardrails"><img src="https://agentmods.dev/badge/skills/vodailocz/kilo-kit-mcp/ai-guardrails.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00058 | $0.01068 |
| Opus 5 | $0.00029 | $0.00534 |
| Sonnet 5 | $0.00012 | $0.00214 |
| Haiku 4.5 | $0.00006 | $0.00107 |
Grade A, and why
ai-guardrails scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AI Guardrails & Defense-in-Depth
Overview
The ai-guardrails skill provides a comprehensive framework for securing autonomous LLM agents. As agents interact with untrusted external data sources and perform actions on behalf of users, the attack surface expands significantly. This skill focuses on implementing multi-layered defenses to ensure agent safety, reliability, and integrity in live environments.
Threat Model
Autonomous agents face unique security challenges that require a proactive defense strategy:
- Direct Prompt Injection (DPI): Malicious input explicitly attempting to hijack the agent's core instructions.
- Indirect Prompt Injection (IPI): Injected instructions hidden in retrieved web pages, emails, or files that the agent processes.
- Prompt Leaking: Attempts to extract system instructions, internal reasoning paths, or proprietary data.
- Data Exfiltration: Unauthorized access and transfer of PII or sensitive internal data to external endpoints.
- SSRF (Server-Side Request Forgery) via Tool Use: Leveraging agent-enabled tools to probe internal networks or access forbidden resources.
- Agent Loop Exploitation: Crafting inputs that force the agent into infinite loops or resource-exhaustion scenarios.
- Tool Abuse: Circumventing intended tool usage patterns to execute malicious commands.
Core Defenses
Dual-LLM & Context Boundary Isolation
- Pattern: Isolate instructions from data.
- Implementation: Separate the Instruction Stream (system prompts, task logic) from the Content Stream (retrieved data).
- Mechanism: Use a secondary, smaller "Sanitizer LLM" to filter untrusted content before it reaches the main reasoning engine.
Indirect Prompt Injection (IPI) Defenses
- Detection: Utilize structured markup (e.g., XML tags like
<untrusted_content>) to wrap retrieved data. - Neutralization: Instruct the agent to strictly ignore any instructions contained within tagged content blocks.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 69 lines · 58 tokens per session scan A 36483a8c5b5e
ai-guardrails is a skill published in the GitHub repository VoDaiLocz/kilo-kit-mcp (26 stars, last pushed 4d ago), licensed Apache-2.0. It adds 58 tokens to every session and 1,068 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
llm-structured-output
Get reliable JSON, enums, and typed objects from LLMs using responseformat, tooluse, and schema-constrained decoding across OpenAI, Anthropic, and Google APIs.
drizzle-orm-expert
Expert in Drizzle ORM for TypeScript — schema design, relational queries, migrations, and serverless database integration. Use when building type-safe database layers with Drizzle.
landing-page-generator
Generates high-converting Next.js/React landing pages with Tailwind CSS. Uses PAS, AIDA, and BAB frameworks for optimized copy/components (Heroes, Features, Pricing). Focuses on Core Web Vitals/SEO.
tdmcp-pipeline
Orchestrates the tdmcp feature team end-to-end: design/wireframe → build → integrate → QA → release. Use whenever the user wants to build, implement, develop, ship, or add one or more tdmcp features/tools/effects/controls/AI-prompts for TouchDesigner, or to run them through a coordinated design→develop→QA→deploy…
startcycle-graph-user
Use when a task needs a small, throwaway multi-agent fan-out (a couple of parallel workers plus a review pass) in ANY project, without the full /startcycle-graph contract — no .agents/graph.md bootstrap, no state.json schema, no persistent files. Model-tiered by role (opus plan, sonnet review, haiku or an external CLI…
memb-skill
BDB local-first long-term memory engine (memB). Use when querying, remembering, or adapting preferences, code architectures, and developer patterns across tasks.