Hire an AI app instruction and spending safeguards

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• A map of where outside text reaches the model, with layered defences added
• Test cases so each defence stays in place
• A per-run and per-day spending cap, with limits on loops, retries and parallel calls
• An attack report, ranked, showing which defences held and what is still open

How it does the job well

• Name the asset, the threat and the impact before recommending controls.
• Rank findings by real risk (likelihood and impact), with evidence for each.
• Prefer fixes that remove a problem over warnings that rely on people.
• Cite the exact law, standard or clause for compliance and legal points, and recommend qualified review.

Mistakes it avoids

• Long lists of generic issues with no evidence they apply.
• Testing or scanning systems without permission.
• Presenting a legal opinion as final.

What a good result looks like

An example, not your task: Your app reads web pages, emails, files or user messages and passes them to a model.

• Step 1: AI app injection defender. Where outside text reaches the model, the layers of defence added, and test inputs to try.
• Step 2: Test gap finder. Which defences your tests cover, which they miss, which are unknown, and new test cases for the gaps.
• Spending caps. Every paid call found, a cap per run and per day, limits on loops and retries, and a dashboard match.
• Step 4: AI system attack tester. Ranked findings, the known attack type for each, which defences held and what is still open.
• HAND-BACK SUMMARY. Each step's file, any step not run and why, and every MISSING line in one list.

How the work is checked

• Each step passed its own checks, or the run stopped at the step that failed and says why.
• The steps ran in order, and each one used the result of the one before.
• Nothing was invented to fill a gap. Every gap is a MISSING: line.
• Nothing was sent, published or paid for without a clear yes.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

Capabilities

• Add defences against hidden instructions. Maps every route for outside text into the model, then adds layers that clean the input, fence the instructions, check the output and plant a marker that shows leaks.
• Check the defences have tests. Reads the defences from step 1, searches your tests for ones that would fail if a defence broke, and writes test cases for the gaps.
• Add the tests and merge. This one is yours. Add the tests, run them and merge the defences so the next step reads the updated code.
• Cap the spending. Finds every paid call, sets a cap per run and per day, bounds loops and retries, and matches the caps to the limit in your provider dashboard.
• Merge the caps and run the app. This one is yours. Merge the caps and run the app once so the final test attacks the finished version.
• Attack the finished app. Runs injection and jailbreak tests against a test model or test keys only, unless you confirm a live target. Tries to trick the tools, maps each finding to a known attack type and says which defences held.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id harden-an-ai-app-against-hijacked-instructions-and-runaway-bills only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/harden-an-ai-app-against-hijacked-instructions-and-runaway-bills/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• Your AI app's code (a folder or repo the AI can open)
• Which paid services it calls, and the limit you are willing to spend per day
• What tools or actions the model can use (optional)
• Your test folder (optional)

Functions and deliverables

• AI app instruction and spending safeguards: Share your app code and test setup. Get proposed code safeguards, test gaps, spending limits and an attack-test report where checks can run.
  • A map of where outside text reaches the model, with layered defences added
  • Test cases so each defence stays in place
  • A per-run and per-day spending cap, with limits on loops, retries and parallel calls
  • An attack report, ranked, showing which defences held and what is still open
• AI app injection defender: Find where hijacked instructions can reach your AI app, then add layers of defence. Get screening code and attack tests for prompt injection.
  • A map of where attacks can enter
  • A layered defence plan
  • Starter screening code
  • Tool permission rules
  • A set of attack tests
  Source: sickn33.
• Code change test coverage reviewer: Find what a code change does that no test checks. Give it your diff and tests. Get each behaviour marked covered or not, plus test cases for gaps.
  • A list of new behaviours
  • A covered, not covered or unknown label for each
  • Evidence for each label
  • Proposed test cases for the gaps
  Source: Pro Skill Packs.
• AI spend limit checker: Check code that calls paid AI services for spend limits. Get a cost cap on every call, a hard count on every loop and retry, and a list of caps to set.
  • A cost line for each call site
  • Hard limits on loops and retries
  • Repeat-safe keys where calls can double up
  • A list of provider caps to set
  Source: sickn33.
• AI system attack tester: Find prompt injection, jailbreak and tool abuse risks in your AI app prompts. Get ranked findings with a fix for each. No live app needed.
  • Prompt injection and jailbreak findings, matched by pattern in your prompt text
  • Risk scores for data leaks and data poisoning, taken from fixed tables
  • Tool misuse risks for agents
  • Each finding mapped to a MITRE ATLAS attack ID, a public list of attacks on AI
  • Guardrail fixes ranked by severity
  Source: Alireza Rezvani.
• AI project context organiser: Share your project and next task. Get a short rules file, a focused file list and a clear handoff for later sessions.
  • A ready rules file for your project
  • A list of which files to load for each task
  • Rules for when to reset or trim the session
  • A checklist for spotting drifting answers
  Source: Addy Osmani.

Tasks you can use it for

• Your app reads web pages, emails, files or user messages and passes them to a model.
• Your app calls paid AI services in a loop, a queue or a background job.
• You are about to launch an AI feature and want proof it resists simple attacks.

Limits to check before starting

• Your app reads no outside text and makes no paid AI calls: use a standard code review instead.
• You only want to know what your AI app might cost: ask your AI provider for its usage and billing page, or a developer, for a quick check.
• You have no code to share, only a chat tool or a hosted product: ask the vendor for its security details.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Download the handoff pack. It is a zip with HANDOFF.md and every skill file this workflow uses.
• Give the folder to Claude, in Claude Code or as files in a Claude Project, and say "Follow HANDOFF.md". It needs to open and edit your code.
• Work on a test copy with test keys, never live keys or customer data.
• Only your code is required. Paid services, a daily limit, tools and tests are optional, but they make the caps and defences fit better.
• Pause after step 2. Add the tests, run them and merge the defences.
• Pause after step 3. Merge the spending caps and run the app once. Then the final attack test runs on the finished app.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/harden-an-ai-app-against-hijacked-instructions-and-runaway-bills for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.