ai-guardrailslisted

**CONSUMES**: User LLM/agent pipeline description + optional existing guardrail configs + the inputs/outputs/tools the agent touches **PRODUCES**: Applied guardrail judgment rules + layered defense architecture + prompt-injection mitigations + PII de-identification config + output/tool-call validation gates + content-moderation tool selection + OWASP-mapped findings # AI Guardrails & LLM I/O Security Capability Pack **Version**: 0.1.0 **Compatibility**: Claude Code (Phase 1); Codex / Cursor / Gemini in Phase 3 **License**: Apache 2.0 --- ## What This Pack Does AI agents wire an LLM straight to a database, a shell, or an email API and trust whatever it returns. They "sanitize" prompt injection with a keyword blocklist that any Base64 or typoglycemia payload walks straight past. They moderate content with a single API and never measure its false-positive rate. They send raw enterprise text — names, emails, card numbers — to a third-party model with no PII redaction. They accept a syntactically valid JSON tool call (`{"action":"execute_command","parameter":"rm -rf /"}`) as if valid JSON meant safe content. This pack embeds the judgment rules that LLM security engineers apply automatically — rules from OWASP Gen AI Security guidance, real guardrail tooling documentation (Presidio, NeMo Guardrails, Llama Guard, Lakera, Rebuff, Pydantic AI), and published red-team benchmarks. **Pack = LLM security judgment. Your workflow system = process constraints. No overlap.** --- ## C