prompt-injection-defense

The fragment is defensive security code, not apparent malware. It contains several design weaknesses that can allow prompt injection or unauthorized tool use despite the intended protections. Unescaped context fields, regex-only sanitization, advisory delimiters, weak sensitive-tool confirmation, and permitting a call with one high-severity issue should be remediated. The omitted helper implementations prevent complete assessment.