Prompt Injection Defense

Defend the agent's instruction and context surface against text engineered so a human reviewer sees one thing while the model reads another. The vector is Unicode that is invisible, direction-altering, or visually misleading - hidden in the files an agent treats as authority (CLAUDE.md, AGENTS.md, SKILL.md, .cursorrules), in MCP tool descriptions, and in content pulled in at runtime (web fetches, issue bodies, dependency READMEs).

The defining property of this threat: what a human reviewer sees is not what the model reads. Every control below closes that gap - by detecting the divergence (scan) or eliminating it (sanitize / review raw bytes).

Which move, when

Paths are relative to this skill folder. Launch the scripts through scripts/run-python.sh (see Scripts); ... below stands for bash scripts/run-python.sh scripts/.