AI Blocks › Keep your code secure
Stop your AI app being hijacked by hidden text or draining your account
Give it your AI app. Get layered defences, tests, spending caps and a fresh attack test.
Harden an AI app against hijacked prompts and runaway bills is a free AI workflow for the job "Keep your code secure". It guides your AI through several skills in order, passing each step's output to the next.
Free · No account · Made by AI Blocks · Level: advanced · Thinking: high
What it does
An AI app has two ways to hurt you. Text it reads, such as a web page, an email or a file, can carry hidden orders that change what it does. And a loop or retry can call a paid service thousands of times overnight. Most teams fix one and miss the other, or add defences with no tests, so the next edit removes them. The steps cover both and then prove it. First it maps every place outside text reaches the model and adds defences in layers. Next it checks that tests cover each defence. You add the tests and merge. Then it adds spending caps and limits on loops and retries. You merge those and run the app. Last it attacks the finished app with injection and jailbreak tests, and tells you which defences held.
You give it
- Your AI app's code (a folder or repo the AI can open)
- Which paid services it calls, and the limit you are willing to spend per day
- What tools or actions the model can use (optional)
- Your test folder (optional)
You get
- A map of where outside text reaches the model, with layered defences added
- Test cases so each defence stays in place
- A per-run and per-day spending cap, with limits on loops, retries and parallel calls
- An attack report, ranked, showing which defences held and what is still open
Use it when
- Your app reads web pages, emails, files or user messages and passes them to a model.
- Your app calls paid AI services in a loop, a queue or a background job.
- You are about to launch an AI feature and want proof it resists simple attacks.
Steps
- AI app injection defender: Point it at your AI app. Get the weak spots found and layered defences added against hijacked instructions.
- Code change test coverage review: Give it a code change and your tests. Get each new behaviour marked covered or not, plus test cases for the gaps.
- AI spend limit checker: Point it at code that calls paid AI services. Get spending caps and loop limits added before a surprise bill.
- AI system attack tester: Point it at an AI app. Get prompt injection, jailbreak and tool abuse risks found, ranked and mapped to known attacks.
How to use it
- Download the handoff pack. It's a zip with HANDOFF.md and every skill file this workflow uses.
- Give the folder to Claude (in Claude Code, or as files in a Claude Project) and say "Follow HANDOFF.md".
- Work on a test copy with test keys, never live keys or customer data.
- Do both of your steps. Merge the defences with tests, then merge the caps and run the app.