Guide · Agent skill
How to use the Prompt Guard agent skill: setup and examples
Updated · written with AI from the project's own documentation and checked against our catalogue data
The prompt-guard skill teaches your AI agent how to build a prompt injection and jailbreak filter around Meta's Prompt Guard model, an 86M-parameter text classifier. It is aimed at developers who build LLM applications that take user input or pull in web, API, or RAG documents. After this guide you will know what the skill does, how to add it to your agent, how to phrase requests that trigger it, and what you need before the code will run.
Prompt GuardOrchestra-Research/AI-Research-SKILLs · MIT Download the skill Quick start
- 1Install the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or your project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
- 2Install Python dependencies. Run pip install transformers torch in the environment where your application runs.
- 3Get access to the model. Create a HuggingFace account, accept Meta's licence for meta-llama/Prompt-Guard-86M, and set up a token your code can use.
- 4Ask the agent for a filter. Describe where the text comes from and what you want done with flagged items, such as blocking user input or discarding documents.
- 5Choose thresholds for each source. Use the skill's suggested thresholds as a starting point: 0.5 for user input and 0.3 for third-party data, then adjust with your own test cases.
- 6Test with known attacks and normal text. Run examples like the ones in the skill and your own benign messages, and check both missed attacks and false alarms.
- 7Add other safety layers. Keep Prompt Guard as one layer among several, and use LlamaGuard for content moderation as the skill recommends.
What agent skills are and what this one does
An agent skill is a folder with a SKILL.md file that gives an AI agent specific instructions and reference material for a task. When the skill is loaded, the agent can follow its guidance while helping you.
The prompt-guard skill covers Meta's Prompt Guard model. The agent can write code that scores user messages, API responses, or retrieved documents and blocks or flags those that look like attacks before they reach a language model. It does not change how the agent itself behaves; it helps you build a safety filter into your own application.
- BENIGN (label 0): normal content
- INJECTION (label 1): embedded instructions in data
- JAILBREAK (label 2): direct override attempts
Install the prompt-guard skill
Download the ZIP from the skill's page on this site and unzip it. You can put the skill in your personal skills folder at ~/.claude/skills/, or in a project's .claude/skills/ folder so it applies only to that project.
If you use the Claude apps instead, upload the skill under Settings → Capabilities → Skills.
- Personal: ~/.claude/skills/
- Project: .claude/skills/ inside your project folder
- Claude apps: Settings → Capabilities → Skills
Set up what the code needs
The skill's code uses Python with the transformers library and PyTorch. Install them with the command below.
The model is gated. You need a HuggingFace account, you must accept Meta's licence for meta-llama/Prompt-Guard-86M on HuggingFace, and you need a HuggingFace token that your code can use to download it.
pip install transformers torchTrigger the skill with natural requests
You do not need special syntax. Describe the job in plain language and mention the thing you are protecting. Requests such as the ones below should bring up the skill's guidance.
Be specific about where the text comes from. User chat messages, API responses and RAG documents use different thresholds in the skill, so say which one you have.
- Add a prompt injection check to my chatbot's user input before it reaches the LLM.
- Filter the documents my RAG pipeline retrieves for hidden instructions.
- Write a function that scores API responses for embedded commands and discards suspicious ones.
- Batch-screen a list of web pages for prompt injection using Prompt Guard.
Understand the scores and thresholds
The skill's basic function returns the jailbreak probability for a text. For user input it blocks at 0.5 by default. For third-party data, it sums the injection and jailbreak probabilities and uses a lower threshold of 0.3.
Languages covered are English, French, German, Spanish, Portuguese, Italian, Hindi, and Thai. The skill's own performance figures are 99.7% true positive rate in-distribution and 97.5% out of distribution, with 0.6% and 3.9% false positive rates respectively.
- User input: block when jailbreak score is 0.5 or higher
- Third-party data: block when injection plus jailbreak score is 0.3 or higher
- Long texts: the model reads up to 512 tokens, so chunk longer text
score = get_jailbreak_score("Ignore previous instructions")
if score > 0.5:
print("⚠️ Jailbreak attempt detected!")Handle long texts and false positives
Texts longer than 512 tokens are truncated, so an injection at the end can be missed. The skill suggests a sliding window with overlapping chunks for long text.
Security discussions can be flagged as attacks. The skill's suggested fix is a context-aware threshold, for example a higher threshold for trusted users. Treat that as a tuning choice, not a guarantee.
def filter_with_context(text, user_is_trusted):
score = get_jailbreak_score(text)
# Higher threshold for trusted users
threshold = 0.7 if user_is_trusted else 0.5
return score < thresholdWhat people use it for
- Screening chatbot user messages for jailbreak phrases like developer mode or ignore all previous instructions before they reach the model.
- Checking retrieved documents in a RAG pipeline for embedded instructions, and dropping or quarantining the ones that score high.
- Validating third-party API responses or scraped web pages before the agent acts on them.
- Batch-scoring a large set of documents in groups of 32 with a single tokenized pass per batch.
Frequently asked questions
How do I install the prompt-guard skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or a project's .claude/skills/ folder for one project. In the Claude apps, you can instead upload it under Settings → Capabilities → Skills.
What do I need to run the code?
You need Python, the transformers library, and PyTorch. You also need access to the gated meta-llama/Prompt-Guard-86M model on HuggingFace, which requires a HuggingFace account, accepting Meta's licence, and a token.
Is Prompt Guard free to use?
The skill is listed under the MIT licence. The model is gated and requires you to accept Meta's licence on HuggingFace, so check that licence for your own use.
Does Prompt Guard catch every prompt injection?
No. The skill reports 3.9% false positives out of distribution and says misses are possible, so it should be one layer among several safety checks.
What should I use instead for content moderation?
The skill points to LlamaGuard for content moderation of violence, hate, or criminal planning. Prompt Guard is designed for prompt injection and jailbreak detection.
Why is my normal security question getting flagged?
The skill notes that legitimate technical queries about prompt injection can score above the threshold. Its suggested fix is a higher threshold for trusted users, and you should test the threshold on your own traffic.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Choose this skill if you are a developer building an LLM app that handles user input or third-party documents and you want a small, CPU-friendly first-pass filter across eight languages. Skip it if you want a ready-made app or only need content moderation, since the skill itself says LlamaGuard is the better tool for that.
Download the skill