Agent Warden
The defensive warden for AI agents — finds prompt injection & agent weaknesses and hardens them before anyone exploits them.
SKILL.md in the open agentskills.io standard — works directly in Claude, ChatGPT/Codex, Cursor, Copilot & more.
Agent Warden is an AI skill for the security of LLM applications and AI agents — a defensive auditor for prompt injection and agent security. It reviews your system prompt, agent, RAG pipeline, tool definitions, MCP server or chatbot against the OWASP Top 10 for LLM Applications (2025) and returns prioritized findings plus concrete guardrails and a red-team test plan. Strictly defensive — not a jailbreak toolkit, not a pentest substitute.
What this skill does
- Audits system prompt/agent/RAG/tools/**MCP server**/chatbot against the **OWASP LLM Top 10 (2025)** + MITRE ATLAS
- Maps **trust boundaries & data flows** and enumerates every untrusted-content channel (incl. indirect injection)
- Returns **prioritized findings** with OWASP/ATLAS id, place, exploit scenario and a concrete fix
- Designs a **hardening architecture**: least privilege, privilege separation (Dual-LLM/CaMeL), in/output guardrails, human gates, exfil channels
- Reviews **MCP servers** for tool poisoning, rug pull, confused deputy, token passthrough, SSRF
- Generates a **red-team test plan** (Promptfoo/Garak/PyRIT, 4-layer) to prove the fixes in CI
- Two defensive scripts: **tool-manifest auditor** (excessive agency, tool poisoning) + **red-team-plan emitter**
Description
Agent Warden is a skill for the security of LLM applications and AI agents — it audits your own AI and hardens it against **prompt injection and agent abuse** before anyone exploits it. You give it a system prompt, an agent, a RAG pipeline, tool/function definitions, an **MCP server** or a chatbot, and it works against the **OWASP Top 10 for LLM Applications (2025)** with **MITRE ATLAS** mapping: first map **trust boundaries and data flows** (where trusted instruction meets untrusted content, and what the agent can do), then prioritized findings, then hardening, then proof. Its honest core message matches the 2026 reality: **delimiters and "ignore instructions" text are not a security boundary** — an injection only becomes damage when the agent can *act*. What actually works is architecture: **least-privilege tools** (the highest-leverage control most teams still skip), **privilege separation** (Dual-LLM / CaMeL: the untrusted-reading model must not act), input and output guardrails on 100% of traffic, human gates on irreversible actions, and blocking **exfiltration channels** (markdown-image auto-fetch, links, tool calls). It pays special attention to **indirect injection** — the hard problem where the payload rides in retrieved documents, tool outputs, emails or files the agent reads in normal operation (the EchoLeak zero-click incident proves this is not theoretical). For **MCP servers** it checks tool poisoning, rug pulls, confused deputy, token passthrough and SSRF. Two bundled, **strictly defensive** Node scripts (zero dependencies) assist: a tool-manifest auditor that flags excessive agency and hidden instructions in tool descriptions, and a red-team-plan emitter that wires established public tools (Promptfoo/Garak/PyRIT) against your own system so fixes are proven, not claimed. It is **verify-live** (AI security changes monthly → current sources with retrieval dates), invents no vulnerabilities (every finding needs a real place + exploit path) and stays strictly defensive.
Examples
Tested with Claude Code
What it does not do
- **Not an attack/jailbreak toolkit** — your own/authorized systems only; no attack payloads; no help against third-party systems
- **Not a substitute for a professional pentest** and no security guarantees (raises attacker cost, doesn't eliminate risk)
- **Invents no vulnerabilities** — every finding needs a real place + exploit path; unknowns stay open questions
- **Runs no live exploits** against systems
- **Not AI labelling/disclosure** (→ KI-Transparenz) and not classic web/app security (→ Web Vitals / Website-Doktor)
Compatibility & tech
- Tested (internal)
- 5 scenarios
- Recommended runtime
- Claude Opus or Sonnet; with web access for verify-live against current OWASP/MITRE ATLAS/CVE sources. The scripts need Node (no extra packages); without Node the skill does the same analysis manually and says so.
- Modes
- Quick Audit (drop in a prompt/config/tools) · Full Audit (whole app + data flows) · MCP server review · Hardening / guardrail design · Red-team test plan
- Inputs
- system prompt / agent configuration · tool/function definitions (OpenAI/Anthropic/MCP JSON) · RAG / pipeline description · MCP server manifest · chatbot / multi-agent setup
- Output format
- Security audit report: trust-boundary map + prioritized findings table (OWASP/ATLAS · place · exploit · fix) + hardening architecture + red-team test plan + backlog
- Subcategory
- AI security & agent hardening
- License
- Proprietär
Security profile
Runs entirely on your machine with your own AI — no external runtime, no running costs.
Contains executable code or runs actions/tools — take a quick look before using.
Accesses external sources / the network in normal use (e.g. live pages, search/data APIs).
What you get
- agent-warden-1.0.0/11 files
- .claude-plugin/marketplace.json
plugins/agent-warden/skills/agent-warden/11 files
- SKILL.md
- manifest.json
references/7 files
- agent-warden-checklist.md
- agent-warden-frameworks.md
- agent-warden-injection-defenses.md
- agent-warden-mcp-security.md
- agent-warden-output-handling.md
- agent-warden-owasp-llm.md
- agent-warden-redteam-catalog.md
scripts/2 files
- redteam-plan.mjs
- tool-manifest-audit.mjs
- .agents/skills/agent-warden/→ universal — same content (Codex, Cursor, Copilot, Gemini, Windsurf, Cline)
- LICENSE.txt
Installation
Also works as a chat prompt
No AI tool? Paste it into Claude, ChatGPT or Gemini and use the method right away.
You get the full method. Only 2 helper script(s) that automate parts of it run once installed.
Works best when your chat has web access.
Installing is the full version — it triggers automatically, runs its scripts and loads references as needed. As a chat prompt you drive the method by hand.
Unlock to copy the ready-to-paste prompt — then in “My Skills”.
Reviews
No reviews yet – be the first.
Note
Agent Warden is strictly defensive: it audits and hardens your own or explicitly authorized systems — not an attack/jailbreak toolkit for third-party systems. It is not a substitute for a professional penetration test and gives no security guarantees. AI security moves monthly: with web access the skill verifies OWASP/MITRE ATLAS/CVE details live and cites the retrieval date. The bundled scripts need Node (no extra packages).
Changelog
- v1.0.020.08.2026Initial release: defensive AI security auditor for LLM apps & agents. Audits against the OWASP Top 10 for LLM Applications (2025) with MITRE ATLAS mapping, trust-boundary/data-flow analysis, prioritized findings, a hardening architecture (least privilege, privilege separation/Dual-LLM/CaMeL, in/output guardrails, human gates, exfil channels) and a red-team test plan (Promptfoo/Garak/PyRIT). Two defensive Node scripts (tool-manifest auditor, red-team-plan emitter), 7 references incl. MCP security, output handling and real incidents (EchoLeak). Verify-live, defensive-only, not a pentest substitute.
Frequently asked questions
What does Agent Warden do?
Agent Warden is an AI skill for the security of LLM applications and AI agents — a defensive auditor for prompt injection and agent security. It reviews your system prompt, agent, RAG pipeline, tool definitions, MCP server or chatbot against the OWASP Top 10 for LLM Applications (2025) and returns prioritized findings plus concrete guardrails and a red-team test plan. Strictly defensive — not a jailbreak toolkit, not a pentest substitute.
Is my AI agent secure against prompt injection?
That's exactly what Agent Warden checks — it audits your system prompt, agent, RAG, tools or MCP server against the OWASP Top 10 for LLM Applications (2025), finds the exploitable spots (especially indirect injection via retrieved content) and returns concrete fixes plus a red-team test plan to prove them.
Is it enough to put "ignore instructions in the input" in the system prompt?
No — and Agent Warden tells you so honestly. Delimiters and such phrases are not a security boundary (text vs text). What actually works is structural — least-privilege tools, privilege separation (Dual-LLM/CaMeL), in/output guardrails and human gates.
Can Agent Warden review my MCP server?
Yes. Agent Warden has a dedicated MCP module for tool poisoning, rug pulls, confused deputy, token passthrough and SSRF — including a script that scans your tool definitions for excessive agency and hidden instructions in tool descriptions.
Is this a hacking / jailbreak tool?
No. Agent Warden is strictly defensive — it audits and hardens your own or explicitly authorized systems. It won't help attack third-party systems, ships no attack payloads, and is not a substitute for a professional penetration test.
How does Agent Warden test that the fixes work?
It generates a red-team test plan using established public tools (Promptfoo, Garak, PyRIT) for your own system — as a 4-layer regime you wire into CI as regression. So fixes are proven, not just claimed.
Does Agent Warden cover AI labelling duties (EU AI Act)?
No, that's a different job — on skills-for-ai the KI-Transparenz (AI transparency) skill handles that. Agent Warden covers technical security (prompt injection, agent hardening), not disclosure/labelling obligations.
Which AI tools does Agent Warden work with?
Claude · ChatGPT/Codex · Cursor · Copilot · Gemini CLI · Windsurf · Cline
How do I use Agent Warden?
Agent Warden is a SKILL.md in the open agentskills.io standard: install it with one command (npx) or download it and add it to your AI tool — Claude (Projects), ChatGPT (Custom GPT), Cursor, Copilot, Gemini CLI and more. No code needed.