Safety Scan
- 648 installs
- 67k repo stars
- Updated August 4, 2026
- ruvnet/ruflo
safety-scan is a Claude agent skill that scans untrusted text for prompt injection and adversarial patterns using AIDefence for developers who must validate user input before model or tool execution.
About
safety-scan is a ruflo security skill that inspects untrusted input—user submissions, API payloads, webhook bodies, and tool outputs—for prompt injection, jailbreak attempts, and unsafe content before agents pass data to models or execute commands. It calls Claude Flow AIDefence MCP tools including `aidefence_scan`, `aidefence_analyze`, `aidefence_is_safe`, `aidefence_learn`, and `aidefence_stats`. Developers reach for safety-scan at ingestion boundaries where external text could manipulate agent behavior. The skill accepts raw input text and returns safety verdicts suitable for blocking or quarantining hostile content in production agent workflows.
- Scans agent prompts and tool-use patterns against 70+ safety rules
- Blocks high-risk actions including shell, network, and secrets access
- Provides severity-bucketed reports with remediation steps
- Works with Claude Code, Cursor, and generic agent runtimes
- Hard gate before any agent execution that touches filesystem or APIs
Safety Scan by the numbers
- 648 all-time installs (skills.sh)
- +10 installs in the week ending Jul 26, 2026 (Skillselion tracking)
- Ranked #463 of 2,203 Security skills by installs in the Skillselion catalog
- Data as of Aug 5, 2026 (Skillselion catalog sync)
npx skills add https://github.com/ruvnet/ruflo --skill safety-scanAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 648 |
|---|---|
| repo stars | ★ 67k |
| Last updated | August 4, 2026 |
| Repository | ruvnet/ruflo ↗ |
How do you block prompt injection in agent inputs?
Automatically detect and block unsafe tool calls, prompt injections, and disallowed operations before an agent executes them.
Who is it for?
Developers shipping agents that ingest untrusted external text from webhooks, forms, or third-party APIs before model inference.
Skip if: Internal-only agent workflows with fully trusted, operator-controlled prompts and no external user or webhook input.
When should I use this skill?
Untrusted user text, webhook data, or API payloads arrive and must be scanned before model calls or tool execution.
What you get
AIDefence scan results, safety verdicts, adversarial pattern analysis, and optional learning stats for blocked inputs.
- Safety verdict from aidefence_is_safe
- Adversarial pattern analysis report
By the numbers
- Integrates 5 AIDefence MCP tools: scan, analyze, is_safe, learn, and stats
Files
Safety Scan
Scan content for prompt injection, jailbreak attempts, and unsafe patterns.
When to use
Before processing untrusted input (user submissions, API payloads, webhook data), scan it to detect prompt injection, adversarial content, or policy violations.
Steps
1. Quick safety check — call mcp__claude-flow__aidefence_is_safe with the input text for a boolean safe/unsafe result 2. Deep analysis — call mcp__claude-flow__aidefence_analyze for detailed threat classification and confidence scores 3. Full scan — call mcp__claude-flow__aidefence_scan for comprehensive multi-layer scanning 4. Train defenses — call mcp__claude-flow__aidefence_learn with confirmed threats to improve detection 5. View stats — call mcp__claude-flow__aidefence_stats for detection rates and false positive metrics
Threat categories
- Prompt injection (direct and indirect)
- Jailbreak attempts
- Data exfiltration patterns
- Instruction override attacks
- Social engineering prompts
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85How it compares
Choose safety-scan when you need AIDefence-backed injection scanning inside ruflo agent flows instead of ad-hoc regex filters on untrusted text.
FAQ
What threats does safety-scan detect?
safety-scan detects prompt injection, jailbreak attempts, and other unsafe adversarial patterns in untrusted text. AIDefence MCP tools analyze input before it reaches a model or triggers Bash or other agent tools.
What input sources should safety-scan run on?
safety-scan is designed for user submissions, API payloads, webhook data, and untrusted tool outputs. Run it at ingestion boundaries before passing content to an LLM or executing downstream agent actions.