PromptShield · AI 安全盾（防注入 / 防泄漏 / 防越权一站式）

技能文档

---
name: promptshield
display_name: PromptShield · AI 安全盾
display_name_en: PromptShield — AI Safety Shield
slug: ai-safety-suite
title: PromptShield · AI 安全盾（防注入 / 防泄漏 / 防越权一站式）
version: 1.0.0
description: "One install, your agent stops leaking secrets and obeying injected instructions: a lifecycle suite for agent runtime safety — red-team drill -> injection shield -> prompt-leak scan -> tool-call / loop / MCP guards -> skill admission gate. Orchestrates 9 independently published sub-skills by slug; vendors no internals. Use when the user wants prompt-injection defense, prompt/secret leak scanning, runtime call guarding, or a skill admission gate."
description_zh: "一次安装，让你的智能体不再泄漏密钥、不再被注入指令带偏：面向智能体运行时安全的生命周期套件——红队演练 -> 注入防护 -> 提示词泄漏扫描 -> 工具调用/失控循环/MCP 守卫 -> 技能准入门禁。按 slug 编排 9 个已独立发布的子技能，不内嵌子包内部实现。当用户要防提示词注入、扫描密钥泄漏、给工具调用加守卫或做技能准入门禁时使用。"
description_en: "One install, your agent stops leaking secrets and obeying injected instructions: a lifecycle suite for agent runtime safety — red-team drill -> injection shield -> prompt-leak scan -> tool-call / loop / MCP guards -> skill admission gate. Orchestrates 9 independently published sub-skills by slug; vendors no internals."
read_when:
  - 用户要给智能体做安全防护：防提示词注入、防泄漏、防越权调用
  - 上线前要跑红队演练 / 对抗测试，看智能体会不会被注入带偏
  - 发布系统提示词或技能前要扫泄漏、扫注入、过准入门禁
  - 用户说「prompt 被注入了怎么办」「密钥会不会漏给模型」「工具调用怎么加守卫」
agent_created: true
author: SynomosAI
license: MIT
license_scope: "代码（.py / .js 路由脚本）MIT；本 SKILL.md 与其中方法论文本不在 MIT 覆盖范围内"
allowed-tools: Read, Grep, Bash
category: AI 安全
platforms: [windows, macos, linux, cli]
copyright: SynomosAI
classification:
  skillhub: ["security-compliance"]
  iso_25010: ["Security"]
risk_tier: low
risk_rationale: "纯文档编排 + 只读路由脚本：不调用外部 API、不读写业务数据、不代执行安全动作；仅按 slug 索引已有子技能。"
tags: [security, prompt-injection, leak-scan, red-team, tool-call-guard, admission-gate, ai-safety, 合集, PromptShield]
ai_protocol: true
spec: usk/1.0
interface:
  type: cli
  entry_point: scripts/promptshield_flow.py
  runtime: python3
  call_pattern: args
input_schema:
  args:
    type: string
    description: "--list 列出安全生命周期五环节；--route <stage|slug> 给出该环节的调用说明与预期输出"
    required: false
output_schema:
  stdout: 路由表（环节 | slug | 何时用 | 调用说明 | 预期输出）
  exit_code: "rc=0 正常；rc=2 未知环节/slug"
changelog: "1.0.0: Initial bilingual collection (PromptShield / ai-safety-suite) — orchestrates 9 published agent-runtime-safety sub-skills by slug; mirrors superpowers methodology-suite shape with LGD three-law badges embedded."
---

> 凡自治之物 · LGD 治理学 · 创造术家族 ｜ 评测协议：skill-quality-gate

**LGD 三律状态带 / Three-laws badge line (read from LGD dashboard 2026-10-17):**
`[有籍 REGISTERED] 9/9 ✓ · [有证 EVIDENCED] 9/9 ✓ · [有门禁 GATED] 9/9 ✓`
(fleet-wide: 有籍 113/113 = 100% · 有证 112/113 = 99.1% · 有门禁 112/113 = 99.1%)

## English

### What this is
A **collection / orchestration** skill: one install that wires the full **agent runtime-safety lifecycle** end to end. It does not re-implement any detection logic — it routes you, stage by stage, to 9 sub-skills that are already published and maintained on their own. Treat this as the table of contents; the sub-skills are the chapters.

The safety lifecycle:

`red-team drill -> injection shield -> leak scan -> runtime guards -> admission gate`

```
  RED-TEAM ──────▶ SHIELD ──────▶ LEAK ──────▶ GUARD ──────▶ GATE
 ┌────────────┐   ┌────────────┐   ┌────────────┐   ┌──────────────┐   ┌────────────┐
 │ redteam    │   │ injection  │   │ prompt-leak│   │ tool-call    │   │ skill      │
 │ kit (conf.)│──▶│ shield     │──▶│ scanner    │──▶│ loop-guard   │──▶│ admission  │
 │ injection  │   │            │   │ token-disc │   │ mcp-security │   │ gate       │
 │ drill      │   │            │   │ -check     │   │ scan         │   │            │
 └────────────┘   └────────────┘   └────────────┘   └──────────────┘   └────────────┘
  attack first    block hostile    find what we     control what the    decide what may
  (see what to    input at        expose before     agent is allowed    enter the
   defend)        runtime          shipping          to call             library
```

### Entry index (slug | stage | when to use | call note)

| # | Stage | Sub-skill slug | When to use | Call note | Expected output |
|---|-------|----------------|-------------|-----------|-----------------|
| 1 | Red-team drill | `agent-redteam-kit` *(confidential kit — referenced by capability name only)* | Before launch: adversarially stress-test the agent | Invoke the sub-skill for the drill | Scored attack-surface report + fix list |
| 2 | Red-team drill | `prompt-injection-drill` | Generate adversarial injection samples to harden against | Invoke the sub-skill with your prompt type | Drill cases + pass/fail verdicts |
| 3 | Injection shield | `prompt-injection-shield` | Hostile user/tool input must be blocked at runtime | Invoke the sub-skill on the prompt | Allow/block guard decision |
| 4 | Leak scan | `prompt-leak-scanner` | Before shipping a system prompt: catch internal/secret leakage | Invoke the sub-skill on the prompt | Leak findings (line-level) |
| 5 | Leak scan | `token-disclosure-check` | Before publishing any token/asset disclosure document | Invoke the sub-skill on the disclosure doc | Disclosure-completeness verdict + gaps |
| 6 | Runtime guard | `tool-call-guard` | Before the agent calls external tools: gate the call | Invoke the sub-skill on the proposed call | L0–L4 allow/block decision |
| 7 | Runtime guard | `agent-loop-guard` | Long-running agents that may loop or repeat-read | Invoke the sub-skill on the run trace | Repeat/loop detection + stop advice |
| 8 | Runtime guard | `mcp-security-scan` | Before wiring a new MCP server/tool into the agent | Invoke the sub-skill on the MCP config/toolset | Risk findings + high-risk count |
| 9 | Admission gate | `skill-admission-gate` | Before any third-party skill enters your library | Invoke the sub-skill on the skill dir | Gate verdict; blocks admission on blockers |

### Per-stage notes
- **1–2. Attack first.** You can't defend what you haven't attacked. Run the red-team kit and the injection drill early; feed their findings into stages 3–5.
- **3. Runtime shield.** Block hostile instructions *as they arrive*, before they drive tool calls.
- **4–5. Leak discipline.** Scan the prompt you ship out (4) and any disclosure document before it goes public (5).
- **6–8. Control plane.** Three guards, three surfaces: the tool call itself (6), runaway loops (7), and the MCP toolset you plug in (8).
- **9. Admission.** The last gate before an untrusted skill ever reaches your library.

### Quantified evidence bars (measured, not promised)
- **9/9 sub-skills three-law green**: 有籍 7/7 fields, 有证 3/3 artifacts, in-ledger = true — read live from `LGD三律达标率看板_20261017.json` (scanned 2026-10-17 10:39).
- **718 cumulative ModelScope downloads** across the 9 sub-skills (baseline 2026-10-17 11:21): redteam 96 · leak 95 · drill 94 · loop-guard 94 · shield 81 · mcp 81 · tool-guard 74 · token-disc 70 · admission 33.
- **Batch eval RPT-20261016-TOP20-B**: 9/9 executable PASS, 9/9 reproducible PASS (SHA re-run identical), verdict CONDITIONAL on every package — **0 FAIL**; open defects are S2/S3 design notes (fail-open exit-code family; CI must parse JSON output), not broken behavior.

### Demo
```bash
# list the whole safety lifecycle
python3 scripts/promptshield_flow.py --list

# get the call note for one stage
python3 scripts/promptshield_flow.py --route guard

# ...or by sub-skill slug
python3 scripts/promptshield_flow.py --route tool-call-guard
```

### Scope & red lines
- This suite **vendors no sub-skill internals**. It references sub-skills by slug only; their code stays in their own packages.
- `agent-redteam-kit` is a **confidential kit**: this suite cites its capability name and safety role only — no drill internals, payloads, or scripts are reproduced here.
- Pure documentation + a read-only router. No network, no business-data writes, no acting on your behalf.

## 中文

### 这是什么
一个**合集/编排**技能：一次安装，把**智能体运行时安全**的完整生命周期串起来。它不重写任何检测逻辑——而是按环节，把你路由到 9 个已独立发布、各自维护的子技能。本合集是目录，子技能是章节。

安全生命周期：

`红队演练 -> 注入防护 -> 泄漏扫描 -> 运行时守卫 -> 准入门禁`

```
  红队演练 ──────▶ 注入防护 ──────▶ 泄漏扫描 ──────▶ 运行时守卫 ──────▶ 准入门禁
 ┌────────────┐   ┌────────────┐   ┌────────────┐   ┌──────────────┐   ┌────────────┐
 │ redteam    │   │ injection  │   │ prompt-leak│   │ tool-call    │   │ skill      │
 │ kit(保密)  │──▶│ shield     │──▶│ scanner    │──▶│ loop-guard   │──▶│ admission  │
 │ injection  │   │            │   │ token-disc │   │ mcp-security │   │ gate       │
 │ drill      │   │            │   │ -check     │   │ scan         │   │            │
 └────────────┘   └────────────┘   └────────────┘   └──────────────┘   └────────────┘
  先攻一遍         运行时拦注入      发出前查泄漏      管住它能调什么      决定什么能
 （知道防什么）    （到达即拦）      （发货前自查）    （工具/循环/MCP）    进你的库
```

### 入口索引（slug | 环节 | 何时用 | 调用说明）

| # | 环节 | 子技能 slug | 何时用 | 调用说明 | 预期输出 |
|---|------|-------------|--------|----------|----------|
| 1 | 红队演练 | `agent-redteam-kit` *（保密包：仅引用能力名）* | 上线前对抗性压测智能体 | 调子技能跑演练 | 攻击面评分报告 + 修复清单 |
| 2 | 红队演练 | `prompt-injection-drill` | 生成对抗注入样例做加固 | 对 prompt 类型调子技能 | 演练用例 + 对错判定 |
| 3 | 注入防护 | `prompt-injection-shield` | 运行时需拦截恶意输入 | 对 prompt 调子技能 | 放行/拦截判定 |
| 4 | 泄漏扫描 | `prompt-leak-scanner` | 发系统提示词前查泄漏 | 对 prompt 调子技能 | 泄漏发现（行级） |
| 5 | 泄漏扫描 | `token-disclosure-check` | 披露文件公开发出前 | 对披露文档调子技能 | 披露齐备性判定 + 缺项 |
| 6 | 运行时守卫 | `tool-call-guard` | 智能体调外部工具前加闸门 | 对拟调用调子技能 | L0–L4 放行/拦截判定 |
| 7 | 运行时守卫 | `agent-loop-guard` | 长任务可能死循环/重复读 | 对运行轨迹调子技能 | 重复/循环检出 + 停机建议 |
| 8 | 运行时守卫 | `mcp-security-scan` | 接入新 MCP server/工具集前 | 对 MCP 配置调子技能 | 风险发现 + 高风险计数 |
| 9 | 准入门禁 | `skill-admission-gate` | 第三方技能入库存之前 | 对技能目录调子技能 | 门禁结论；有阻断项即禁入 |

### 环节说明
- **1–2. 先红队。** 没攻过就谈不上防。尽早跑红队演练，把发现喂给 3–5。
- **3. 运行时防护。** 恶意指令**到达即拦**，在它驱动工具调用之前。
- **4–5. 泄漏纪律。** 发出的提示词先扫（4），披露文档公开前再扫（5）。
- **6–8. 控制面。** 三道守卫管三个面：工具调用本身（6）、失控循环（7）、接入的 MCP 工具集（8）。
- **9. 准入。** 不可信技能进库前的最后一道门。

### 量化证据条（实测，非承诺）
- **9/9 子技能三律全绿**：有籍 7/7 字段、有证 3/3 工件、在台账=true——实读 `LGD三律达标率看板_20261017.json`（2026-10-17 10:39 扫描）。
- **9 子技能魔搭累计 718 下载**（基线 2026-10-17 11:21）：红队 96 · 泄漏 95 · 演练 94 · 循环护栏 94 · 注入 81 · MCP 81 · 调用守卫 74 · 披露 70 · 准入 33。
- **批量评测 RPT-20261016-TOP20-B**：9/9 可执行 PASS、9/9 可复现 PASS（SHA 复跑一致），verdict 全部 CONDITIONAL——**0 FAIL**；遗留缺陷均为 S2/S3 设计注记（fail-open 退出码族，CI 须解析 JSON 输出），非行为损坏。

### 示例
```bash
# 列出安全生命周期全流程
python3 scripts/promptshield_flow.py --list

# 查某个环节怎么调
python3 scripts/promptshield_flow.py --route guard

# 也可按子技能 slug 查
python3 scripts/promptshield_flow.py --route tool-call-guard
```

### 边界与红线
- 本合集**不内嵌任何子技能内部实现**，仅按 slug 引用；子包代码留在各自包内，不改不复制。
- `agent-redteam-kit` 为**保密包**：本合集只引用其能力名与安全角色——不复制演练内部用例、载荷或脚本。
- 纯文档 + 只读路由脚本：无网络、不写业务数据、不代你执行任何动作。

使用说明

# PromptShield · AI Safety Suite (slug: ai-safety-suite)

> **One install, your agent stops leaking secrets and obeying injected instructions.**
> 一次安装，让你的智能体不再泄漏密钥、不再被注入指令带偏。

[![LGD-有籍](https://img.shields.io/badge/有籍-REGISTERED-2ea44f)](#)
[![LGD-有证](https://img.shields.io/badge/有证-EVIDENCED-2ea44f)](#)
[![LGD-有门禁](https://img.shields.io/badge/有门禁-GATED-2ea44f)](#)
[![bilingual](https://img.shields.io/badge/docs-EN%20first%2FZH%20complete-blue)](#)
[![style](https://img.shields.io/badge/style-methodology%20collection-orange)](#)

---

## English

### What is PromptShield
A **methodology collection** for agent runtime safety — the same shape as the top-of-ecosystem superpowers collections: one repo, one `SKILL.md` orchestrator, multi-vendor plugin shims, and a one-page ASCII lifecycle map. Where external collections ship *tools without governance*, PromptShield ships **theory (LGD three laws) + skills + evidence chain + admission gates** as one auditable unit.

### The safety lifecycle (one page)

```
  RED-TEAM ──────▶ SHIELD ──────▶ LEAK ──────▶ GUARD ──────▶ GATE
 ┌────────────┐   ┌────────────┐   ┌────────────┐   ┌──────────────┐   ┌────────────┐
 │ redteam    │   │ injection  │   │ prompt-leak│   │ tool-call    │   │ skill      │
 │ kit (conf.)│──▶│ shield     │──▶│ scanner    │──▶│ loop-guard   │──▶│ admission  │
 │ injection  │   │            │   │ token-disc │   │ mcp-security │   │ gate       │
 │ drill      │   │            │   │ -check     │   │ scan         │   │            │
 └────────────┘   └────────────┘   └────────────┘   └──────────────┘   └────────────┘
  attack first    block hostile    find what we     control what the    decide what may
  (see what to    input at        expose before     agent may call      enter the
   defend)        runtime          shipping                             library
```

### The 9 sub-skills (referenced by slug; internals not vendored)

| Stage | Slug | ModelScope downloads* | Batch eval RPT-20261016-TOP20-B |
|---|---|---:|---|
| Red-team drill | `agent-redteam-kit` *(confidential — capability name only)* | 96 | SK-008 · exec PASS · repro PASS (sha 36040bd2) |
| Red-team drill | `prompt-injection-drill` | 94 | SK-090 · exec PASS · repro PASS (sha 1718b133) |
| Injection shield | `prompt-injection-shield` | 81 | SK-091 · exec PASS · repro PASS (sha 2ca190cc) |
| Leak scan | `prompt-leak-scanner` | 95 | SK-092 · exec PASS · repro PASS (sha f14b1c73) |
| Leak scan | `token-disclosure-check` | 70 | SK-104 · exec PASS · smoke-checked |
| Runtime guard | `tool-call-guard` | 74 | SK-105 · exec PASS · repro PASS (sha da86d544) |
| Runtime guard | `agent-loop-guard` | 94 | SK-005 · exec PASS · repro PASS (sha 20f0771) |
| Runtime guard | `mcp-security-scan` | 81 | SK-076 · exec PASS · repro PASS (sha 6387bc8b) |
| Admission gate | `skill-admission-gate` | 33 | SK-099 · exec PASS · repro PASS (sha d55d3f84) |

\* ModelScope download counts, baseline fetched 2026-10-17 11:21:38. Cumulative across the 9: **718**.
Batch verdicts: all CONDITIONAL (0 FAIL) — open defects are S2/S3 design notes (fail-open exit family; CI must parse JSON output), not broken behavior.

### LGD three-laws badge line (read live 2026-10-17)
- 有籍 REGISTERED: **9/9 ✓** (fleet 113/113 = 100%)
- 有证 EVIDENCED: **9/9 ✓** (fleet 112/113 = 99.1%)
- 有门禁 GATED: **9/9 ✓** (fleet 112/113 = 99.1%)

### Install (one-liner per agent)

| Agent CLI | Install |
|---|---|
| Claude Code | `claude plugin install promptshield@promptshield`  · or copy `.claude-plugin/` shim into your plugins dir |
| Codex | drop `.codex-plugin/` next to your project, or run `install.ps1` / `install.sh` |
| Cursor | copy `.cursor-plugin/` shim into `.cursor/` plugins |
| Any CLI with skills/ support | `git clone https://github.com/zhaoxinghua09-cell/promptshield.git` and point it at this repo |

```bash
# quick start after clone
python3 scripts/promptshield_flow.py --list       # the whole lifecycle
python3 scripts/promptshield_flow.py --route guard   # how to run the guard stage
```

### Repo layout
```
promptshield/
├── SKILL.md                 # main orchestration (bilingual EN-first)
├── README.md                # this file (bilingual)
├── scripts/
│   └── promptshield_flow.py # read-only router (--list / --route)
├── .claude-plugin/          # Claude Code shim
├── .codex-plugin/           # Codex shim
├── .cursor-plugin/          # Cursor shim
├── install.ps1 / install.sh # one-click installer
└── LICENSE                  # MIT (router code only)
```

## 中文

### PromptShield 是什么
一个面向**智能体运行时安全**的**方法论合集**——形态对标生态头部的 superpowers 合集：单仓、一个 `SKILL.md` 主编排、多厂商插件 shim、一页 ASCII 生命周期图。外部合集只给工具不给治理；PromptShield 把**理论（LGD 三律）+ 技能 + 证据链 + 准入门禁**做成一个可审计的整体。

### 安全生命周期（一页图）

```
  红队演练 ──────▶ 注入防护 ──────▶ 泄漏扫描 ──────▶ 运行时守卫 ──────▶ 准入门禁
 ┌────────────┐   ┌────────────┐   ┌────────────┐   ┌──────────────┐   ┌────────────┐
 │ redteam    │   │ injection  │   │ prompt-leak│   │ tool-call    │   │ skill      │
 │ kit(保密)  │──▶│ shield     │──▶│ scanner    │──▶│ loop-guard   │──▶│ admission  │
 │ injection  │   │            │   │ token-disc │   │ mcp-security │   │ gate       │
 │ drill      │   │            │   │ -check     │   │ scan         │   │            │
 └────────────┘   └────────────┘   └────────────┘   └──────────────┘   └────────────┘
  先攻一遍         运行时拦注入      发出前查泄漏      管住它能调什么      决定什么能
 （知道防什么）    （到达即拦）      （发货前自查）    （工具/循环/MCP）    进你的库
```

### 9 个子技能（按 slug 引用，不复制内部实现）

| 环节 | slug | 魔搭下载* | 批量评测 RPT-20261016-TOP20-B |
|---|---|---:|---|
| 红队演练 | `agent-redteam-kit`（保密包：仅引用能力名） | 96 | SK-008 · 可执行 PASS · 可复现 PASS（sha 36040bd2） |
| 红队演练 | `prompt-injection-drill` | 94 | SK-090 · 可执行 PASS · 可复现 PASS（sha 1718b133） |
| 注入防护 | `prompt-injection-shield` | 81 | SK-091 · 可执行 PASS · 可复现 PASS（sha 2ca190cc） |
| 泄漏扫描 | `prompt-leak-scanner` | 95 | SK-092 · 可执行 PASS · 可复现 PASS（sha f14b1c73） |
| 泄漏扫描 | `token-disclosure-check` | 70 | SK-104 · 可执行 PASS · 本轮冒烟抽检 |
| 运行时守卫 | `tool-call-guard` | 74 | SK-105 · 可执行 PASS · 可复现 PASS（sha da86d544） |
| 运行时守卫 | `agent-loop-guard` | 94 | SK-005 · 可执行 PASS · 可复现 PASS（sha 20f0771） |
| 运行时守卫 | `mcp-security-scan` | 81 | SK-076 · 可执行 PASS · 可复现 PASS（sha 6387bc8b） |
| 准入门禁 | `skill-admission-gate` | 33 | SK-099 · 可执行 PASS · 可复现 PASS（sha d55d3f84） |

\* 魔搭下载量，基线采集于 2026-10-17 11:21:38。9 包累计 **718**。批量 verdict 全部 CONDITIONAL（0 FAIL）——遗留缺陷均为 S2/S3 设计注记（fail-open 退出码族，CI 须解析 JSON 输出），非行为损坏。

### LGD 三律状态带（2026-10-17 实读）
- 有籍 REGISTERED：**9/9 ✓**（全库 113/113 = 100%）
- 有证 EVIDENCED：**9/9 ✓**（全库 112/113 = 99.1%）
- 有门禁 GATED：**9/9 ✓**（全库 112/113 = 99.1%）

### 安装（每个 agent 一条命令）

| Agent CLI | 安装方式 |
|---|---|
| Claude Code | `claude plugin install promptshield@promptshield` · 或把 `.claude-plugin/` shim 拷进插件目录 |
| Codex | 把 `.codex-plugin/` 放到项目旁，或运行 `install.ps1` / `install.sh` |
| Cursor | 把 `.cursor-plugin/` shim 拷进 `.cursor/` 插件目录 |
| 任何支持 skills/ 的 CLI | `git clone https://github.com/zhaoxinghua09-cell/promptshield.git` |

```bash
# 克隆后快速开始
python3 scripts/promptshield_flow.py --list        # 完整生命周期
python3 scripts/promptshield_flow.py --route guard  # 守卫环节怎么调
```

### 仓结构
```
promptshield/
├── SKILL.md                 # 主编排（双语英前中后）
├── README.md                # 本文件（双语）
├── scripts/
│   └── promptshield_flow.py # 只读路由（--list / --route）
├── .claude-plugin/          # Claude Code shim
├── .codex-plugin/           # Codex shim
├── .cursor-plugin/          # Cursor shim
├── install.ps1 / install.sh # 一键安装脚本
└── LICENSE                  # MIT（仅路由代码）
```

---

*PromptShield · SynomosAI · part of the LGD skill family. This collection references sub-skills by slug only; no sub-package internals are vendored, and the confidential `agent-redteam-kit` is cited by capability name only.*

如何安装此技能？

访问技能市场，点击「安装」按钮，按提示将技能包放入 AI 编程助手的 skills 目录即可。