Automated security audit skill that red-teams GodMode's prompt injection defenses by testing all three security shields against known attack patterns.
When to Run
After onboarding completes (part of setup validation)
After changing guardrail configuration
Periodically as a health check
When the user asks to "red team" or "security audit"
How to Run
Call the security.audit RPC:
security.audit({})
Options
security.audit({
shields: ["prompt_shield", "output_shield", "config_shield"], // test specific shields
saveReport: true // save to ~/godmode/data/security-audits/
})
What It Tests
Prompt Shield (10+ tests)
Direct instruction overrides ("ignore previous instructions")
DAN/jailbreak attempts ("you are now DAN")
Fake system messages ("[SYSTEM] new directive")
Prompt extraction via roleplay
Emotional manipulation / social engineering
Base64 encoded injections
Developer mode requests
Tool enumeration attacks
Authority claim attacks ("as an Anthropic engineer")
False positive checks (normal messages that should NOT be flagged)
Output Shield (6+ tests)
API key leaks (sk-, xai-, ghp_*)
System prompt recitation (structural markers)
Config file JSON leaks
Environment variable leaks
False positive checks (normal code and task output)
Config Shield (8+ tests)
Direct config file reads (cat ~/.openclaw/openclaw.json)
Read tool targeting sensitive paths
SSH key access attempts
AGENTS.md / SOUL.md tool reads
$HOME expansion bypass attempts
False positive checks (normal bash and read operations)
Interpreting Results
The audit returns:
Score: 0-100% (should be 100% for production)
Grade: A+ through F
Per-shield breakdown: How many tests passed per category
After running the audit, present results to the user as a security report:
Show the overall score and grade prominently
List each shield's pass/fail count
If any failures, explain what failed and why it matters
Include the recommendations
If score is 100%, congratulate — their defenses are solid
Report Storage
Reports are saved to ~/godmode/data/security-audits/ with timestamps.
Use these to track security posture over time.
1---2name: red-team-audit3description: Red Team Security Audit4---5# Red Team Security Audit67Automated security audit skill that red-teams GodMode's prompt injection defenses by testing all three security shields against known attack patterns.89## When to Run1011- After onboarding completes (part of setup validation)12- After changing guardrail configuration13- Periodically as a health check14- When the user asks to "red team" or "security audit"1516## How to Run1718Call the `security.audit` RPC:1920```21security.audit({})22```2324### Options2526```27security.audit({28 shields: ["prompt_shield", "output_shield", "config_shield"], // test specific shields29 saveReport: true // save to ~/godmode/data/security-audits/30})31```3233## What It Tests3435### Prompt Shield (10+ tests)36- Direct instruction overrides ("ignore previous instructions")37- DAN/jailbreak attempts ("you are now DAN")38- Fake system messages ("[SYSTEM] new directive")39- Prompt extraction via roleplay40- Emotional manipulation / social engineering41- Base64 encoded injections42- Developer mode requests43- Tool enumeration attacks44- Authority claim attacks ("as an Anthropic engineer")45- False positive checks (normal messages that should NOT be flagged)4647### Output Shield (6+ tests)48- API key leaks (sk-*, xai-*, ghp_*)49- System prompt recitation (structural markers)50- Config file JSON leaks51- Environment variable leaks52- False positive checks (normal code and task output)5354### Config Shield (8+ tests)55- Direct config file reads (cat ~/.openclaw/openclaw.json)56- Read tool targeting sensitive paths57- SSH key access attempts58- AGENTS.md / SOUL.md tool reads59- $HOME expansion bypass attempts60- False positive checks (normal bash and read operations)6162## Interpreting Results6364The audit returns:65- **Score**: 0-100% (should be 100% for production)66- **Grade**: A+ through F67- **Per-shield breakdown**: How many tests passed per category68- **Failures**: List of tests that failed with details69- **Recommendations**: Specific fixes if any tests fail7071### Grading Scale72- **A+ (100%)**: All shields fully operational73- **A (90-99%)**: Minor gaps, low risk74- **B (80-89%)**: Some gaps need attention75- **C-F (<80%)**: Critical security gaps, fix immediately7677## Presenting Results7879After running the audit, present results to the user as a security report:80811. Show the overall score and grade prominently822. List each shield's pass/fail count833. If any failures, explain what failed and why it matters844. Include the recommendations855. If score is 100%, congratulate — their defenses are solid8687## Report Storage8889Reports are saved to `~/godmode/data/security-audits/` with timestamps.90Use these to track security posture over time.
Run npx skillmds@latest add godmode-team/red-team-audit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Red Team Security Audit It is listed under Security on SkillMD.
This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
GodMode-Team (@godmode-team) published this skill. Their other Agent Skills are listed on their SkillMD profile.
GodMode-Team