Compare agent skills before installing.

Apply input minimisation, output discipline, and a human-in-the-loop gate to every surface that sends data to an LLM. Triggers when building or editing any send-to-LLM path: an Edge Function calling a model, a draft-commentary or summary generator, an auto-resolver, a cash-allocation suggestion, a classification call, or any new AI-assist feature, especially in a RICS or UK GDPR regulated context.

Abuse an LLM agent's tools/functions — coerce it to call tools with attacker-chosen args for SSRF, RCE, data exfil, or privilege abuse. Load when the target is an agent with tools/ function-calling/plugins, MCP servers, code interpreters, or "the assistant can do X". Signals: function-calling, tool schemas, browse/email/query/exec tools, autonomous agents.

Bypass an LLM's safety/guardrails to make it produce restricted output or ignore its policy. Load when testing an AI product's content controls, "jailbreak", "guardrail bypass", refusal testing, or safety evals. Signals: a chatbot/assistant with a usage policy, refusals to test, content filters.