defending-llms-with-guardrails

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text can enter the LLM context via the runtime-loaded JSONL corpus (scripts/agent.py → load_corpus() reads --input prompts from an external file, then run_llamaguard() passes each row["prompt"] into tok.apply_chat_template(...) and model.generate(...)).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill loads the Llama Guard model at runtime (AutoTokenizer.from_pretrained / AutoModelForCausalLM.from_pretrained with model_id "meta-llama/Llama-Guard-3-8B"), which downloads weights from https://huggingface.co/meta-llama/Llama-Guard-3-8B and those remote model artifacts directly control the safety-classification behavior used to block/allow prompts (required runtime dependency).