You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: skills/add-ai-protection/SKILL.md
+60-32Lines changed: 60 additions & 32 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
name: add-ai-protection
3
3
license: Apache-2.0
4
-
description: Add AI-specific security to LLM/chat endpoints — prompt injection detection, PII/sensitive info blocking, and token budget rate limiting. Use when building AI chat interfaces, completion APIs, or any endpoint that processes user prompts.
4
+
description: Protect AI chat and completion endpoints from abuse — detect prompt injection and jailbreak attempts, block PII and sensitive info from leaking in responses, and enforce token budget rate limits to control costs. Use this skill when the user is building or securing any endpoint that processes user prompts with an LLM, even if they describe it as "preventing jailbreaks," "stopping prompt attacks," "blocking sensitive data," or "controlling AI API costs" rather than naming specific protections.
Read https://docs.arcjet.com/llms.txt for comprehensive SDK documentation covering all frameworks, rule types, and configuration options.
44
44
45
-
## Why AI Endpoints Need Special Protection
46
-
47
-
AI endpoints are high-value targets:
48
-
49
-
-**Prompt injection** — attackers try to override system prompts, extract training data, or bypass safety rails
50
-
-**PII leakage** — users may paste sensitive data (credit cards, emails, phone numbers) that gets stored in model context or logs
51
-
-**Cost abuse** — each request consumes expensive model tokens; without rate limiting, a single user can exhaust your budget
52
-
-**Automated scraping** — bots can scrape your AI endpoints for data or to find vulnerabilities.
53
-
54
-
Arcjet addresses all of these with rules that run **before** the request reaches your AI model.
45
+
Arcjet rules run **before** the request reaches your AI model — blocking prompt injection, PII leakage, cost abuse, and bot scraping at the HTTP layer.
55
46
56
47
## Step 1: Ensure Arcjet Is Set Up
57
48
@@ -77,13 +68,11 @@ Prevents personally identifiable information from entering model context.
Detection runs **locally in WASM** — no user data is sent to external services. Only available in route handlers (not pages or server actions in Next.js).
81
-
82
71
Pass the user message via `sensitiveInfoValue` (JS) / `sensitive_info_value` (Python) at `protect()` time.
83
72
84
73
### Token Budget Rate Limiting
85
74
86
-
Use `tokenBucket()` / `token_bucket()` for AI endpoints — it allows short bursts while enforcing an average rate, which matches how users interact with chat interfaces.
75
+
Use `tokenBucket()` / `token_bucket()` for AI endpoints — the `requested` parameter can be set proportional to actual model token usage, directly linking rate limiting to cost. It also allows short bursts while enforcing an average rate, which matches how users interact with chat interfaces.
87
76
88
77
Recommended starting configuration:
89
78
@@ -99,24 +88,55 @@ Set `characteristics` to track per-user: `["userId"]` if authenticated, defaults
99
88
100
89
Always include `shield()` (WAF) and `detectBot()` as base layers. Bots scraping AI endpoints are a common abuse vector. For endpoints accessed via browsers (e.g. chat interfaces), consider adding Arcjet advanced signals for client-side bot detection that catches sophisticated headless browsers. See https://docs.arcjet.com/bot-protection/advanced-signals for setup.
101
90
102
-
## Step 3: Compose the protect() Call
103
-
104
-
All rule parameters are passed together in a single `protect()` call. The key parameters for AI:
105
-
106
-
-`requested` — tokens to deduct for rate limiting
107
-
-`sensitiveInfoValue` / `sensitive_info_value` — the user's message text for PII scanning
108
-
-`detectPromptInjectionMessage` / `detect_prompt_injection_message` — the user's message text for injection detection
109
-
110
-
Typically `sensitiveInfoValue` and `detectPromptInjectionMessage` are set to the same value: the user's input message.
111
-
112
-
## Step 4: Handle Decisions
113
-
114
-
For AI endpoints, provide meaningful error responses:
115
-
116
-
-**Rate limited** (`reason.isRateLimit()`) → 429 with message like "You've exceeded your usage limit. Please try again later."
117
-
-**Prompt injection** (`reason.isPromptInjection()`) → 400 with "Your message was flagged as potentially harmful."
118
-
-**Sensitive info** (`reason.isSensitiveInfo()`) → 400 with "Your message contains sensitive information that cannot be processed. Please remove any personal data."
119
-
-**Bot detected** (`reason.isBot()`) → 403
91
+
## Step 3: Compose the protect() Call and Handle Decisions
92
+
93
+
All rule parameters are passed together in a single `protect()` call. Use this pattern:
94
+
95
+
```typescript
96
+
const userMessage =req.body.message; // the user's input
97
+
98
+
const decision =awaitaj.protect(req, {
99
+
requested: 1, // tokens to deduct for rate limiting
Adapt the response format to your framework (e.g., `res.status(429).json(...)` for Express).
120
140
121
141
## Step 5: Verify
122
142
@@ -144,3 +164,11 @@ The Arcjet dashboard at https://app.arcjet.com is also available for visual insp
144
164
**Multiple models / providers**: Use the same Arcjet instance regardless of which AI provider you use. Arcjet operates at the HTTP layer, independent of the model provider.
145
165
146
166
**Vercel AI SDK**: Arcjet works alongside the Vercel AI SDK. Call `protect()` before `streamText()` / `generateText()`. If denied, return a plain error response instead of calling the AI SDK.
167
+
168
+
## Common Mistakes to Avoid
169
+
170
+
- Sensitive info detection runs **locally in WASM** — no user data is sent to external services. It is only available in route handlers, not in Next.js pages or server actions.
171
+
-`sensitiveInfoValue` and `detectPromptInjectionMessage` (JS) / `sensitive_info_value` and `detect_prompt_injection_message` (Python) must both be passed at `protect()` time — forgetting either silently skips that check.
172
+
- Starting a stream before calling `protect()` — if the request is denied mid-stream, the client gets a broken response. Always call `protect()` first and return an error before opening the stream.
173
+
- Using `fixedWindow()` or `slidingWindow()` instead of `tokenBucket()` for AI endpoints — token bucket lets you deduct tokens proportional to model cost and matches the bursty interaction pattern of chat interfaces.
174
+
- Creating a new Arcjet instance per request instead of reusing the shared client with `withRule()`.
Copy file name to clipboardExpand all lines: skills/protect-route/SKILL.md
+46-23Lines changed: 46 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
name: protect-route
3
3
license: Apache-2.0
4
-
description: Add Arcjet security protection to a route handler. Detects framework, imports the shared client, applies appropriate rules, and handles decisions. Use when adding security to API routes, form handlers, or any server-side endpoint.
4
+
description: Add security protection to a server-side route or endpoint — rate limiting, bot detection, email validation, and abuse prevention. Works across frameworks including Next.js, Express, Fastify, SvelteKit, Remix, Bun, Deno, NestJS, and Python (Django/Flask). Use this skill when the user wants to protect an API route, form handler, auth endpoint, or webhook from abuse, even if they describe it as "add rate limiting," "block bots," "prevent brute force," or "secure my endpoint" without mentioning Arcjet specifically.
5
5
metadata:
6
6
pathPatterns:
7
7
- "app/**/route.ts"
@@ -85,35 +85,58 @@ Search the project for an existing shared Arcjet client file (commonly `lib/arcj
85
85
86
86
Select rules based on the route's purpose. If the user specified what they want (via `$ARGUMENTS` or in their prompt), use that. Otherwise, infer from context:
| General server route |`shield()` + `detectBot()`|
96
96
97
97
For routes that need to detect sophisticated bots (headless browsers, advanced scrapers) — especially form submissions, login/signup pages, and other abuse-prone endpoints — recommend adding Arcjet advanced signals. This is a browser-based detection system using client-side telemetry that complements server-side `detectBot()` rules. See https://docs.arcjet.com/bot-protection/advanced-signals for setup instructions.
98
98
99
99
Apply route-specific rules using `withRule()` on the shared instance — do not modify the shared instance directly.
100
100
101
101
## Step 4: Add Protection to the Handler
102
102
103
-
**Key patterns:**
104
-
105
-
- Call `protect()`**inside** the route handler, not in middleware.
106
-
- Call `protect()` only **once** per request.
107
-
- Pass the framework's request object directly.
108
-
- For Next.js pages/server components: use `import { request } from "@arcjet/next"` then `const req = await request()`.
-`403` if `reason.isBot()`, `reason.isShield()`, or `reason.isFilterRule()`
115
-
-`400` if `reason.isSensitiveInfo()`
116
-
-`isErrored()` / `is_error()` — Arcjet fails open. Log the error and allow the request to proceed.
103
+
Call `protect()`**inside** the route handler (not in middleware), only **once** per request, passing the framework's request object directly. For Next.js pages/server components: use `import { request } from "@arcjet/next"` then `const req = await request()`.
104
+
105
+
Use this pattern:
106
+
107
+
```typescript
108
+
const decision =awaitaj.protect(req);
109
+
110
+
if (decision.isDenied()) {
111
+
if (decision.reason.isRateLimit()) {
112
+
returnResponse.json(
113
+
{ error: "Too many requests" },
114
+
{ status: 429 },
115
+
);
116
+
}
117
+
if (decision.reason.isBot() ||decision.reason.isShield() ||decision.reason.isFilterRule()) {
118
+
returnResponse.json(
119
+
{ error: "Forbidden" },
120
+
{ status: 403 },
121
+
);
122
+
}
123
+
if (decision.reason.isSensitiveInfo()) {
124
+
returnResponse.json(
125
+
{ error: "Bad request" },
126
+
{ status: 400 },
127
+
);
128
+
}
129
+
}
130
+
131
+
// Arcjet fails open — log errors but allow the request
0 commit comments