little-canary

Name: little-canary Review
Item: little-canary
Rating: 2.8
Author: Aaron Matthews

Skill Development Usable

Works inClaude Code

Usable Scanned — metadata only

Reduces prompt injection risk by testing untrusted input against a lightweight model before it reaches production systems, catching behavioral anomalies that…

Detects prompt injection by its effect on a sacrificial canary model, not just pattern matching: untrusted input hits a powerless model first, a behavioral check reads the residue, and it returns block, flag, or pass before your primary model acts. Inbound preflight sensor, not a guarantee.

Ask Claude to screen user inputs for prompt injection before processing sensitive requests
Automatically flag suspicious prompts that attempt to override system instructions or constraints
Test untrusted third-party data inputs against injection attacks before feeding to production models

41 starsApache-2.0 (commercial OK)FreeQuick setup

Usable rating — This tool is functional but has notable gaps. Review the evaluation notes below before deploying.

Why it matters

Reduces prompt injection risk by testing untrusted input against a lightweight model before it reaches production systems, catching behavioral anomalies that signature detection misses.

Best for

Teams deploying LLM applications handling user-supplied prompts or external data sources.

Works in

Claude Code Claude Cowork Claude Chat

Source

https://github.com/hermes-labs-ai/little-canary

By hermes-labs-ai

How to Get It

Option 1: Claude Desktop App (Code Mode)Click the + button next to the prompt box → Plugins → Add plugin. Search and click Install. Skills work in Claude Code only.

Option 2: Paste into Claude CodeCopy the command below and paste it into your conversation. Claude will install it.

Command

claude plugins install hermes-labs-ai/little-canary

Tip: Paste this into a Claude Code conversation. Verify command matches your Claude Code version.

Auto-generated from the tool's public listing — not hands-on verified. Cross-check against the source repo's README before running.

First thing to try

After installing, paste this into Claude:

Screen user inputs for prompt injection before processing sensitive requests

CostFree

Trust Signals Auto-scanned

Stars41Contributors11Last updated2026-10-26LicenseApache-2.0 (OK for commercial use)Known CVEsNone foundSources: GitHub Advisory Database + OSV.dev · Scanned 2026-10-30 · scanner v1

Community Pulse Quiet

No community discussions found yet. This doesn't mean the tool isn't good — it may be new or serve a niche use case.

Reviewer notes

Auto-scanned review. These are observations, not a security certification.

Scored from trust signals (evidence-eval-v1): 32 GitHub stars; contributors unknown; last commit 0d ago; license Apache-2.0.

Things to check

Scanned, not hands-on tested — this entry was auto-scanned from public metadata (GitHub metrics, license, security flags). No reviewer has run it, and no tool-specific limitations have been documented yet.

How to evaluate tools before deploying →

Data shown here comes from public APIs and automated scanning. Reviewer notes reflect one person's experience. This is not a security certification or legal recommendation. Always evaluate tools according to your own organization's policies.

Evaluation Scores

Evaluation

Ease of Use

3/5

Versatility

2/5

Reliability

3/5

Security

3/5

Overall score2.75 / 5.00 UsableEvaluatedSep 2026

Scored from trust signals (evidence-eval-v1): 32 GitHub stars; contributors unknown; last commit 0d ago; license Apache-2.0.

← Back to the Claude Observatory