Hire an AI agent injection evidence review assistant

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• A boundary map of every place untrusted text can reach the agent, what it protects and the rules that must always hold
• A control table that marks each safeguard missing, planned, implemented or verified
• A test case plan with a unique ID for each case
• A results ledger with pass, fail, blocked, error or not run for every planned case
• Findings with repeats merged, a fix for each and a retest queue
• A cleanup list of test accounts, files and canary values

How it does the job well

• Prompt wording and classifiers lower risk but are not a security boundary. Real permission checks must be enforced outside the model's reasoning. If a rule rests only on prompt wording, mark it weak.
• A design review cannot prove a defense works. Do not say "protected" or "verified" without test evidence.
• Do not run, simulate or claim a test against any system. Plan cases and record the results the user supplies. If the user has a connected, approved harness, you may run only the cases marked approved, in the approved environment, within the limits.
• Do not authorize targets, widen scope, retrieve secrets, use real customer data or touch another tenant. Do not probe a live system to find out its scope.
• Stop if the target or configuration does not match the approval, a limit is reached, or something unexpected happens. Report it and wait.
• Name the asset, the threat and the impact before recommending controls.
• Rank findings by real risk (likelihood and impact), with evidence for each.

Mistakes it avoids

• Calling a control verified because its design looks right.
• Dropping blocked, error or not-run cases from the counts.
• Using real customer data, real secrets or real recipients as test material.
• Writing cases that could cause harm outside the approved environment.
• Long lists of generic issues with no evidence they apply.
• Testing or scanning systems without permission.

What a good result looks like

An example, not your task: You are about to give an AI agent tools such as email, files or a database and want to know where hostile text could steer it.

• boundary-manifest.md. Every input, tool, secret and output, which inputs outsiders can write to, the rules that must hold and each control's state.
• case-plan.md. Each test case with its ID, input, rule tested, fake data, expected safe result and stop condition.
• result-ledger.md. Pass, fail, blocked, error or not run for every planned case, with evidence and counts against the full plan.
• findings.md. Failures merged by cause, each with the cases, the fix and where to enforce it.
• cleanup-status.md. Test accounts, files and canary values to remove, each marked removed or unknown.
• retest-queue.md. Cases to run again after each fix, who watches for the problem and what stays open.

How the work is checked

• Each finding has a location, evidence, severity and a specific fix.
• Likely false positives are checked and removed.
• Items that need a lawyer or auditor are clearly marked.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

Capabilities

• Check the approval first. It looks for the owner, the exact target, the dates, the limits and a stop contact. If any is missing, it writes a planning checklist and marks every case not run.
• Map the boundaries. It lists each input, tool, secret, memory and output, and marks which inputs an outsider can write to.
• Write the rules that must always hold. Each rule is something code can enforce, such as "retrieved text cannot change which tools are allowed". A rule that rests only on prompt wording is marked weak.
• Plan safe cases. Each case gets an ID, the input it uses, the rule it tests, the fake data it needs, the safe result to expect and when to stop. It adds normal tasks to check the agent still works.
• Record every result. It logs pass, fail, blocked, error or not run for each case, with the evidence you supplied. The total is the full plan, so unrun cases show.
• Merge findings and track cleanup. Failures with the same cause become one finding with a fix at the right place. It lists test accounts and files to remove, and says unknown until you confirm.
• Review fixes and hand off the retest. It updates each control against the same rules, asks for fresh evidence before it says verified, and lists what to retest and who watches for it.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id track-agent-injection-controls-and-retest-evidence only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/track-agent-injection-controls-and-retest-evidence/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• A map of your agent. List what it reads, each tool and its access, its memory and where its output goes (from your architecture notes).
• Written approval to test. Name the agent's owner, the exact system and accounts, the dates, the limits and a person who can stop the test.
• Safe test data, such as fake accounts, canary values that grant no access and the places test output may go
• Your current safeguards, earlier findings and a few normal tasks the agent must still do (optional)
• The agent's version or configuration ID (optional)
• Results from tests you already ran (optional)

Helpful context (optional)

• A diagram or notes of how the agent is built.
• A named person who can stop a test.
• The agent's logs for the test window.

Tools and access

• Claude, ChatGPT or Gemini with file upload: It reads your architecture notes and approval together and keeps a case and result table.
• Your own test environment: The cases must run somewhere safe, with fake accounts. The AI only plans and records.

Functions and deliverables

• Agent injection evidence review assistant: Get safe prompt injection test cases for your AI agent, a control gap list and retest records. Tests run only with the owner's written approval.
  • A boundary map of every place untrusted text can reach the agent, what it protects and the rules that must always hold
  • A control table that marks each safeguard missing, planned, implemented or verified
  • A test case plan with a unique ID for each case
  • A results ledger with pass, fail, blocked, error or not run for every planned case
  • Findings with repeats merged, a fix for each and a retest queue
  • A cleanup list of test accounts, files and canary values
• Prompt injection defender: Describe your AI app. Map prompt-injection risks and safeguards for text it reads.
  • Data flow and trust map
  • Threat model
  • Prioritised defence plan
  • Injection tests
  • Residual risk notes
  Source: Burhan Sebin.
• AI agent attack tester: Share the agent and authorised test scope. Get a test plan, evidence-backed findings and retest results for checks that actually run.
  • Rules of engagement
  • A map of what the agent can reach
  • A numbered test plan using fake data
  • Findings with proof, impact and fixes
  • Retest and cleanup results
  Source: Burhan Sebin.
• Django access control reviewer: Trace who can read, change or delete Django data. Get supported access-control findings, enforcement fixes and clearly marked gaps in the review.
  • A summary of how authorization works in your code
  • Confirmed access control gaps
  • The code path behind each finding
  • A suggested fix for each gap
  Source: sickn33.
• me.md builder: Answer a few questions, or let your AI use what it remembers. Get one private file that tells any AI who you are.
  • One me.md file with up to ten dated sections
  • A list of facts taken from memory, for you to check
  • A short note of what it removed for privacy
  • The two next steps, to save it and set it up

Tasks you can use it for

• You are about to give an AI agent tools such as email, files or a database and want to know where hostile text could steer it.
• Your agent reads outside content like web pages, support tickets or uploaded documents.
• A security reviewer asks for evidence that your injection controls work.
• You fixed a hole and need a retest that points back to the failure it came from.

Limits to check before starting

• You do not own the agent or have no written approval to test it. You get a planning checklist only, and nothing is run.
• You want to test someone else's agent, a live production system or another customer's data. It stops.
• You want a design review and fix plan with no tests. Use the Prompt injection defender.
• You already have an approved test plan and only want to run it. Use the AI agent attack tester.
• You want a general check of your code and packages. Use the Project secrets and package risk review.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Download the pack and add it to your AI, or paste SKILL.md into a new chat. Claude, ChatGPT and Gemini can plan and record. A plain chat cannot run the tests. You run each case in your own approved test setup.
• Attach your agent map and your written approval. Add your test data and safeguards. If you have no written approval, say so. You then get a planning checklist only.
• Say "Plan the cases and record results. Run nothing against any system." Your AI asks once for anything missing.
• Open boundary-manifest.md first. Check that it lists every input and every tool. Add anything it missed.
• Run each approved case in your test setup, then paste the result back. The AI records it as pass, fail, blocked or error. A case you did not run stays "not run".
• After a fix, give it the change and your new test result. Only then does a control become verified. Keep retest-queue.md for the next round.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/track-agent-injection-controls-and-retest-evidence for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.