Prompt Injection Defense

Treat every byte the model reads as adversarial until proven otherwise.

Direct injection (user typing "ignore previous instructions") is the least dangerous variant. The real risk is indirect injection — instructions hidden in a web page, an email, a PDF, or a tool's response — that reach the model alongside trusted instructions and are obeyed without the user ever noticing.

When to use this skill

• The user is building an agent that reads user-controlled documents, web content, or tool results.
• The user is exposing a multi-tenant agent (one user's input feeds another user's run).
• The user reports "the agent did something I never asked for" with no obvious bug in the prompt.
• The user is implementing RAG, web-browsing, or email-handling agents.

Threat model first

There is no general defense against prompt injection — only defenses against specific threats. Name yours: