Merge pull request #4 from BagelHole/codex/add-new-high-ranking-seo-skills-to-readme

2026-08-22 12:49:53 +02:00 · 2026-03-03 12:14:50 -05:00
parent 4401692295 87bd457b23
commit c758521929
11 changed files with 619 additions and 0 deletions
@@ -216,6 +216,10 @@ No agent? No problem. Browse the skills, copy the scripts, use the configs. It's
 | [llm-cost-optimization](devops/ai/llm-cost-optimization/) | Cut LLM API costs with caching, batching, model routing, and self-hosting |
 | [llm-caching](devops/ai/llm-caching/) | Exact and semantic caching layers to reduce API calls by 30–70% |
 | [ai-pipeline-orchestration](devops/ai/ai-pipeline-orchestration/) | Orchestrate RAG ingestion, training, and batch inference with Prefect/Airflow |
+| [llmops-platform-engineering](devops/ai/llmops-platform-engineering/) | Build enterprise LLMOps platforms with evaluation gates, promotions, rollback, and governance |
+| [model-registry-governance](devops/ai/model-registry-governance/) | Define model metadata, approvals, lifecycle policy, and auditable promotion controls |
+| [rag-observability-evals](devops/ai/rag-observability-evals/) | Measure retrieval quality, groundedness, hallucination risk, and RAG regressions continuously |
+| [ai-sre-incident-response](devops/ai/ai-sre-incident-response/) | AI-specific SRE playbooks for model outages, quality regressions, safety incidents, and spend spikes |

 ### Release Management
 | Skill | Description |
@@ -281,6 +285,9 @@ No agent? No problem. Browse the skills, copy the scripts, use the configs. It's
 | [ai-agent-security](security/ai/ai-agent-security/) | Defend agents against injection, tool abuse, and exfiltration |
 | [llm-app-security](security/ai/llm-app-security/) | Harden LLM app inputs, outputs, and tenant isolation |
 | [ai-security-hardening](security/ai/ai-security-hardening/) | Harden LLM deployments against prompt injection, model theft, and data exfiltration |
+| [prompt-injection-defense](security/ai/prompt-injection-defense/) | Defend against direct/indirect prompt injection with isolation, tool controls, and output validation |
+| [ai-red-teaming](security/ai/ai-red-teaming/) | Run adversarial AI red team programs for jailbreaks, exfiltration, and tool abuse resilience |
+| [model-supply-chain-security](security/ai/model-supply-chain-security/) | Protect model artifacts with signing, provenance, SBOM workflows, and trusted promotion policies |

 </details>

@@ -350,6 +357,7 @@ No agent? No problem. Browse the skills, copy the scripts, use the configs. It's
 | [reverse-proxy](infrastructure/networking/reverse-proxy/) | nginx, Traefik |
 | [service-mesh](infrastructure/networking/service-mesh/) | Istio, Linkerd |
 | [llm-gateway](infrastructure/networking/llm-gateway/) | Unified LLM API gateway with routing, rate limiting, virtual keys, and semantic caching |
+| [ai-inference-service-mesh](infrastructure/networking/ai-inference-service-mesh/) | Service mesh patterns for mTLS, canary inference routing, and resilient AI east-west traffic |

 ### Databases
 | Skill | Description |
@@ -387,6 +395,8 @@ No agent? No problem. Browse the skills, copy the scripts, use the configs. It's
 | [llm-inference-scaling](infrastructure/local-ai/llm-inference-scaling/) | Auto-scale LLM inference clusters on Kubernetes with KEDA and GPU-aware scheduling |
 | [rag-infrastructure](infrastructure/local-ai/rag-infrastructure/) | Production RAG with vector stores, hybrid search, embedding pipelines, and reranking |
 | [llm-fine-tuning](infrastructure/local-ai/llm-fine-tuning/) | QLoRA and full fine-tuning with Axolotl, DeepSpeed, and DPO alignment on GPU clusters |
+| [gpu-kubernetes-operations](infrastructure/local-ai/gpu-kubernetes-operations/) | Run GPU Kubernetes clusters with MIG, autoscaling, node health checks, and AI cost controls |
+| [multi-tenant-llm-hosting](infrastructure/local-ai/multi-tenant-llm-hosting/) | Secure multi-tenant LLM hosting with quotas, isolation boundaries, and per-tenant billing controls |

 ### IT Operations
 | Skill | Description |
@@ -0,0 +1,66 @@
+---
+name: ai-sre-incident-response
+description: Build AI-focused SRE incident response practices for LLM outages, degraded quality, runaway cost events, and safety regressions.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# AI SRE Incident Response
+
+Apply SRE rigor to AI systems where incidents include quality regressions, unsafe outputs, and budget explosions.
+
+## AI Incident Classes
+
+- **Availability incident**: model/provider unavailable, timeout storm.
+- **Quality incident**: answer accuracy or tool success drops below SLO.
+- **Safety incident**: harmful or policy-violating outputs increase.
+- **Cost incident**: unexpected token or provider spend spike.
+
+## Severity Framework (Example)
+
+- **SEV1**: user-facing outage, critical compliance risk, or active data leak.
+- **SEV2**: major degradation affecting key flows.
+- **SEV3**: limited impact or internal-only issue.
+
+## Golden Signals for AI Services
+
+- Request success rate
+- Latency (queue + generation + tool execution)
+- Hallucination/groundedness proxy metrics
+- Cost per minute and per tenant
+- Guardrail violation rate
+
+## Response Playbooks
+
+### Model Outage
+1. Freeze deployments.
+2. Shift traffic to fallback model/provider.
+3. Enforce stricter rate limits.
+4. Communicate ETA and mitigation.
+
+### Quality Regression
+1. Roll back prompt/model version.
+2. Disable risky optimization flags.
+3. Increase sampling for trace review.
+4. Re-run latest eval baseline.
+
+### Cost Spike
+1. Identify top tenants/routes/models.
+2. Enable cache + cheaper fallback path.
+3. Apply temporary token caps.
+4. Open postmortem with prevention actions.
+
+## Postmortem Requirements
+
+- Timeline with detector and responder timestamps
+- Blast radius by tenant and feature
+- Missed signals and alert tuning actions
+- Concrete hardening tasks with owners and due dates
+
+## Related Skills
+
+- [incident-response](../../../security/operations/incident-response/) - Standard incident process and evidence
+- [alerting-oncall](../../observability/alerting-oncall/) - Paging and escalation policy
+- [llm-cost-optimization](../llm-cost-optimization/) - Spend controls and efficiency patterns
@@ -0,0 +1,79 @@
+---
+name: llmops-platform-engineering
+description: Build production LLMOps platforms with CI/CD, model promotion workflows, evaluation gates, rollback, and governance across cloud and self-hosted inference.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# LLMOps Platform Engineering
+
+Design and operate an internal LLM platform that supports rapid experimentation without compromising reliability, cost, or compliance.
+
+## Outcomes
+
+- Standardized path from experiment to production
+- Safe model rollout with quality and safety gates
+- Repeatable infra modules for inference, vector DB, and observability
+- Clear ownership model across platform, app, and security teams
+
+## Reference Architecture
+
+1. **Control Plane**: model registry, prompt/version catalog, policy checks, eval pipeline.
+2. **Data Plane**: inference gateway, vector database, cache, feature store.
+3. **Ops Plane**: telemetry, alerting, SLO dashboards, cost analytics.
+4. **Security Plane**: IAM boundaries, secret rotation, content filters, audit logs.
+
+## Golden Delivery Workflow
+
+1. Train/fine-tune or onboard provider model.
+2. Register artifact and metadata (license, intended use, constraints).
+3. Run automated eval suite (quality + safety + latency + cost).
+4. Deploy canary behind gateway with strict traffic policy.
+5. Promote after SLO and business KPI thresholds pass.
+6. Keep rollback target hot for fast reversion.
+
+## CI/CD Design for AI Services
+
+- Build immutable containers with pinned dependencies and model hashes.
+- Use environment promotion: `dev -> stage -> prod`.
+- Fail deployment if:
+  - regression evals drop below baseline,
+  - safety tests exceed risk threshold,
+  - p95 latency exceeds SLO budget.
+- Store deployment evidence for audits (commit SHA, eval report, approver).
+
+## Operational SLOs
+
+- Availability: `99.9%` for synchronous inference endpoints.
+- Latency: p95 under product-specific target (for example, `<1200ms`).
+- Cost: per-request and per-tenant budget ceilings.
+- Quality: task success rate and groundedness thresholds.
+
+## Platform Guardrails
+
+- Enforce tenant quotas and model allow-lists.
+- Require structured output contracts for automation paths.
+- Default to low-risk model settings for critical workflows.
+- Disable unconstrained tool execution in production.
+
+## Tooling Stack (Example)
+
+- **Orchestration**: Argo Workflows / GitHub Actions / Airflow.
+- **Model Registry**: MLflow / custom metadata DB.
+- **Gateway**: LiteLLM / Envoy-based API gateway.
+- **Observability**: OpenTelemetry + Prometheus + Grafana + Langfuse.
+- **Policy**: OPA/Rego for deployment and runtime checks.
+
+## Incident Readiness
+
+- Runbooks for model outage, provider timeout spikes, and cost surges.
+- Chaos drills for provider failover and vector DB degradation.
+- Pre-approved rollback path with one-command execution.
+
+## Related Skills
+
+- [ai-pipeline-orchestration](../ai-pipeline-orchestration/) - Orchestrate ingestion and inference workflows
+- [agent-evals](../agent-evals/) - Build evaluation gates for releases
+- [llm-gateway](../../../infrastructure/networking/llm-gateway/) - Route and control LLM traffic
@@ -0,0 +1,68 @@
+---
+name: model-registry-governance
+description: Establish model registry standards, governance controls, metadata schemas, approvals, and lifecycle policies for enterprise AI deployments.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# Model Registry Governance
+
+Create a trustworthy system of record for model artifacts, prompts, adapters, and evaluation evidence.
+
+## Core Principles
+
+- **Traceability**: every production model maps to source code, data snapshot, and evaluation results.
+- **Reproducibility**: builds are deterministic with pinned dependencies.
+- **Policy-driven promotion**: no manual bypass for critical safety checks.
+- **Lifecycle hygiene**: stale, vulnerable, or unowned models are retired automatically.
+
+## Required Metadata Schema
+
+Track at minimum:
+
+- Model name, semantic version, checksum, and storage URI
+- Base model lineage and fine-tune method
+- Training/eval datasets and time windows
+- License, allowed use cases, prohibited use cases
+- Security risk rating and mitigation controls
+- Owner, backup owner, and escalation contact
+
+## Approval Workflow
+
+1. Registration request created from CI.
+2. Security checks (artifact scan, dependency scan, provenance).
+3. Evaluation package uploaded (quality, toxicity, jailbreak, bias, latency, cost).
+4. Required approvals: platform + product + security (as policy dictates).
+5. Promotion to stage/prod based on signed decision record.
+
+## Lifecycle States
+
+- `draft`: internal experimentation.
+- `candidate`: passed baseline tests.
+- `approved`: authorized for production rollout.
+- `deprecated`: replacement announced, new usage blocked.
+- `retired`: no serving allowed, archived for audit.
+
+## Governance Policies
+
+- Reject artifacts without SBOM/provenance.
+- Block promotion if known critical CVEs remain unresolved.
+- Require refreshed evals after prompt/template changes.
+- Expire approvals after a configurable period (for example 90 days).
+
+## Audit Readiness
+
+Maintain immutable records of:
+
+- Who approved and when
+- Which policy checks executed
+- Which exceptions were granted
+- What model/version served each customer request window
+
+## Related Skills
+
+- [sbom-supply-chain](../../../security/scanning/sbom-supply-chain/) - Provenance and signing
+- [policy-as-code](../../../compliance/governance/policy-as-code/) - Enforce governance with policy engines
+- [llm-fine-tuning](../../../infrastructure/local-ai/llm-fine-tuning/) - Version adapters and training outputs
@@ -0,0 +1,64 @@
+---
+name: rag-observability-evals
+description: Monitor and evaluate RAG systems with retrieval quality metrics, groundedness checks, hallucination detection, and continuous regression testing.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# RAG Observability and Evaluations
+
+Run retrieval-augmented generation like a measurable production system, not a black box.
+
+## What to Measure
+
+### Retrieval Quality
+- Recall@k and MRR for top-k chunks
+- Citation coverage and source freshness
+- Embedding drift and index staleness
+
+### Generation Quality
+- Groundedness score (answer supported by retrieved context)
+- Hallucination rate by route/use case
+- Instruction adherence and format validity
+
+### Reliability and Cost
+- p50/p95 latency split by retrieval vs generation
+- Token usage per stage
+- Cache hit rate and cost per successful answer
+
+## Evaluation Pipeline
+
+1. Curate a benchmark set with gold answers and source docs.
+2. Run nightly offline evals for every retriever/model configuration.
+3. Execute online shadow evals on sampled production traffic.
+4. Gate releases on minimum quality + safety + latency thresholds.
+
+## Alerting Strategy
+
+Page on:
+- sharp decline in groundedness,
+- spike in unanswered or fallback responses,
+- index freshness SLA breach,
+- cost-per-answer anomaly.
+
+## Practical Guardrails
+
+- Force citations for high-risk domains.
+- Return abstain/fallback when confidence is below threshold.
+- Re-rank retrieved chunks before final generation.
+- Use query rewriting only with strict regression tests.
+
+## Incident Triage Checklist
+
+- Did embedding model change?
+- Did chunking/indexing logic change?
+- Did source corpus ingestion fail?
+- Did gateway route to unintended model tier?
+
+## Related Skills
+
+- [rag-infrastructure](../../../infrastructure/local-ai/rag-infrastructure/) - Deploy robust RAG backends
+- [agent-observability](../agent-observability/) - Instrument requests, traces, and costs
+- [agent-evals](../agent-evals/) - Build repeatable eval suites
@@ -0,0 +1,58 @@
+---
+name: gpu-kubernetes-operations
+description: Operate GPU-backed Kubernetes clusters for AI inference and training with scheduling, autoscaling, node health, MIG partitioning, and cost controls.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# GPU Kubernetes Operations
+
+Run resilient and cost-efficient GPU clusters for production AI workloads.
+
+## Key Capabilities
+
+- NVIDIA device plugin and GPU operator lifecycle
+- MIG partitioning for multi-workload efficiency
+- GPU-aware autoscaling (KEDA/cluster autoscaler)
+- Node health checks and proactive remediation
+
+## Cluster Baseline
+
+- Dedicated GPU node pools with taints and tolerations
+- Runtime class and driver/toolkit compatibility checks
+- Local SSD or high-throughput network storage for model weights
+- DCGM metrics exported to Prometheus
+
+## Scheduling Patterns
+
+- Use node affinity by GPU type (A10/L4/A100/H100).
+- Separate latency-critical inference from batch training.
+- Pin model replicas with anti-affinity for availability.
+- Reserve headroom for failover and rolling updates.
+
+## Autoscaling Strategy
+
+- Scale on queue depth + GPU utilization, not CPU alone.
+- Warm spare replicas for large model cold-start mitigation.
+- Cap burst scaling to avoid quota exhaustion.
+
+## Reliability Checks
+
+- ECC error and Xid monitoring
+- GPU memory pressure alerts
+- Driver mismatch detection during upgrades
+- Pod preemption impact analysis
+
+## Cost Optimization
+
+- Prefer MIG slices for smaller inference services.
+- Schedule batch jobs in off-peak windows.
+- Route low-priority traffic to cheaper model tiers.
+
+## Related Skills
+
+- [llm-inference-scaling](../llm-inference-scaling/) - Autoscale inference workloads
+- [model-serving-kubernetes](../../../devops/orchestration/model-serving-kubernetes/) - Production model serving patterns
+- [gpu-server-management](../../servers/gpu-server-management/) - Host-level GPU management fundamentals
@@ -0,0 +1,55 @@
+---
+name: multi-tenant-llm-hosting
+description: Design secure, multi-tenant LLM hosting platforms with tenant isolation, quotas, billing attribution, noisy-neighbor protection, and per-tenant policy controls.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# Multi-Tenant LLM Hosting
+
+Host many teams/customers on shared inference infrastructure without sacrificing security, performance, or cost governance.
+
+## Isolation Model
+
+- Strong tenant identity on every request
+- Per-tenant API keys and scoped model access
+- Namespace or workload isolation for high-risk tenants
+- Strict data retention and log partitioning controls
+
+## Noisy-Neighbor Controls
+
+- Per-tenant RPM/TPM limits
+- Concurrency caps and queue isolation
+- Fair scheduling with weighted priority classes
+- Backpressure and graceful degradation policies
+
+## Billing and Chargeback
+
+Track per-tenant:
+- prompt/completion/cached tokens,
+- model type and route,
+- latency and success rate,
+- cost with markup or internal transfer pricing.
+
+## Security Baseline
+
+- Encrypt data in transit and at rest.
+- Disallow cross-tenant cache leakage.
+- Restrict debug data access by role.
+- Audit all privileged administrative actions.
+
+## Operational Runbook
+
+1. Onboard tenant with policy template.
+2. Issue virtual key and quota profile.
+3. Validate observability and billing tags.
+4. Run tenant-specific load/safety tests.
+5. Enable production traffic with canary limits.
+
+## Related Skills
+
+- [llm-gateway](../../networking/llm-gateway/) - Key management and traffic routing
+- [llm-cost-optimization](../../../devops/ai/llm-cost-optimization/) - Cost controls and optimization tactics
+- [zero-trust](../../../security/network/zero-trust/) - Identity-centric network and access patterns
@@ -0,0 +1,54 @@
+---
+name: ai-inference-service-mesh
+description: Use service mesh patterns for AI inference traffic management, mTLS, canary releases, policy enforcement, and cross-cluster resilience.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# AI Inference Service Mesh
+
+Apply Istio/Linkerd mesh controls to secure and optimize east-west AI traffic across inference microservices.
+
+## Why Mesh for AI
+
+- Enforce mTLS between gateway, retriever, reranker, and model services
+- Apply fine-grained traffic policies without app code changes
+- Run progressive delivery for model-serving backends
+- Observe latency hops for retrieval + generation chains
+
+## Core Patterns
+
+### Security
+- mTLS strict mode cluster-wide
+- AuthorizationPolicy per service account
+- Egress policies for approved model endpoints only
+
+### Traffic Management
+- Canary by header or percentage for new model versions
+- Retry budgets tuned for long-running streaming requests
+- Circuit breakers to protect overloaded inference backends
+
+### Resilience
+- Outlier detection on failing pods
+- Locality-aware routing in multi-zone clusters
+- Failover to secondary cluster/provider
+
+## Observability
+
+- Capture distributed traces across the full AI request path
+- Emit service-level and route-level p95/p99 latency
+- Segment metrics by model and tenant labels
+
+## Pitfalls to Avoid
+
+- Aggressive timeouts that break streaming responses
+- Blanket retries that amplify expensive generation calls
+- Missing identity boundaries between tenant-facing and internal services
+
+## Related Skills
+
+- [service-mesh](../service-mesh/) - Foundational mesh concepts
+- [llm-gateway](../llm-gateway/) - North-south API gateway controls
+- [opentelemetry](../../../devops/observability/opentelemetry/) - End-to-end tracing and metrics
@@ -0,0 +1,55 @@
+---
+name: ai-red-teaming
+description: Run structured AI red team exercises for jailbreak resistance, data exfiltration risk, harmful output controls, and agent tool abuse resilience.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# AI Red Teaming
+
+Continuously test AI applications like an adversary to discover exploitable failure modes before attackers do.
+
+## Program Design
+
+- Define threat scenarios: jailbreaks, policy evasion, prompt injection, model abuse.
+- Build reusable attack suites by domain (support bot, coding agent, RAG assistant).
+- Include multilingual and obfuscated attack prompts.
+- Track results in a risk register with severity and exploitability.
+
+## Test Categories
+
+1. **Jailbreak robustness**: bypassing safety instructions.
+2. **Data exfiltration**: extracting secrets, system prompts, tenant data.
+3. **Tool abuse**: unauthorized API calls or command execution.
+4. **Social engineering**: inducing unsafe business actions.
+5. **Availability abuse**: token amplification and DoS-style prompts.
+
+## Exercise Cadence
+
+- Pre-release blocking red-team gate.
+- Monthly deep-dive campaigns.
+- Post-incident targeted retests.
+
+## Scoring Model
+
+- Likelihood (1-5)
+- Impact (1-5)
+- Detectability (1-5)
+- Control maturity (low/medium/high)
+
+Use scores to prioritize fixes and define SLA for remediation.
+
+## Reporting Essentials
+
+- Reproducible prompt traces
+- Model/version and config used
+- Successful attack chain narrative
+- Recommended mitigations + verification steps
+
+## Related Skills
+
+- [agent-evals](../../../devops/ai/agent-evals/) - Convert findings into regression tests
+- [prompt-injection-defense](../prompt-injection-defense/) - Implement injection countermeasures
+- [penetration-testing](../../operations/penetration-testing/) - Broader offensive security process
@@ -0,0 +1,55 @@
+---
+name: model-supply-chain-security
+description: Secure the AI model supply chain with artifact signing, provenance attestation, SBOM workflows, dependency controls, and trusted model promotion.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# Model Supply Chain Security
+
+Protect models and inference components from tampering, dependency compromise, and untrusted artifact promotion.
+
+## Threats
+
+- Poisoned pretrained weights or adapters
+- Malicious model conversion tools or loaders
+- Compromised build pipelines and registries
+- Insecure runtime images with critical CVEs
+
+## Control Objectives
+
+- Verify artifact integrity end-to-end
+- Prove provenance for every promoted model
+- Detect vulnerable dependencies before deploy
+- Restrict execution to trusted signed artifacts
+
+## Recommended Controls
+
+1. Generate SBOMs for model-serving images and dependencies.
+2. Sign model artifacts and containers (Cosign/Sigstore).
+3. Enforce provenance attestations in CI/CD.
+4. Gate deployments with policy-as-code.
+5. Continuously scan registries for CVEs and drift.
+
+## Promotion Policy Example
+
+A model can move to production only when:
+- checksum matches signed manifest,
+- provenance references approved build workflow,
+- no unresolved critical vulnerabilities,
+- security and platform approvals are present.
+
+## Runtime Hardening
+
+- Run inference containers as non-root.
+- Apply egress restrictions to prevent unauthorized downloads.
+- Mount model volumes read-only when possible.
+- Alert on unsigned artifact pull attempts.
+
+## Related Skills
+
+- [sbom-supply-chain](../../scanning/sbom-supply-chain/) - Generate SBOM and provenance evidence
+- [container-hardening](../../hardening/container-hardening/) - Harden runtime container posture
+- [model-registry-governance](../../../devops/ai/model-registry-governance/) - Controlled lifecycle and approvals
@@ -0,0 +1,55 @@
+---
+name: prompt-injection-defense
+description: Defend AI systems against prompt injection and indirect prompt attacks using input controls, tool permissions, output validation, and isolation boundaries.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# Prompt Injection Defense
+
+Mitigate direct and indirect prompt injection across chat apps, agentic workflows, and RAG pipelines.
+
+## Attack Surface
+
+- User input attempting to override system instructions
+- Untrusted documents/web pages in retrieval context
+- Tool output that smuggles malicious instructions
+- Cross-tenant leakage via shared context windows
+
+## Defense-in-Depth Pattern
+
+1. **Instruction hierarchy enforcement**: system > developer > user > tool output.
+2. **Context segregation**: isolate untrusted text from control instructions.
+3. **Tool permissioning**: explicit allow-list per task and tenant.
+4. **Output policy checks**: validate schema, redact secrets, block unsafe actions.
+5. **Human approval**: required for high-impact operations.
+
+## Implementation Controls
+
+- Strip or label untrusted content blocks before generation.
+- Disable autonomous tool chaining for sensitive workflows.
+- Use deterministic parsers (JSON schema) before tool execution.
+- Reject requests containing high-risk exfiltration patterns.
+- Add canary tokens to detect data exfil attempts.
+
+## Red-Team Test Cases
+
+- "Ignore previous instructions" style direct override
+- Retrieval payload containing hidden policy bypass text
+- Tool output instructing follow-up privileged command
+- Prompt that asks for secrets from memory or env vars
+
+## Security Metrics
+
+- Prompt injection detection rate
+- Unsafe tool invocation prevention rate
+- Time-to-containment for injection attempts
+- False positive rate on blocked safe prompts
+
+## Related Skills
+
+- [ai-agent-security](../ai-agent-security/) - Agent threat model and controls
+- [llm-app-security](../llm-app-security/) - End-to-end LLM app hardening
+- [security-automation](../../operations/security-automation/) - Automated policy response workflows