prompt injection firewall

The problem

Large Language Models cannot natively distinguish between developer instructions and data retrieved from external sources. If your agent reads a malicious email, web page, or document containing "new instructions," it may execute those commands, leading to data exfiltration or unauthorized actions.

What it does

• Scans all incoming text from web scrapes, PDFs, tool outputs, and chat history for imperative language.
• Identifies and labels content by origin (USER, OPERATOR, or UNTRUSTED) to maintain a strict trust boundary.
• Detects six specific attack families including direct overrides, authority fabrication, and obfuscated payloads like Base64.
• Quarantines suspicious directives by paraphrasing them for the user rather than executing them.
• Enforces an incident response playbook that halts the action chain when a threat is detected.

Why this beats prompting it yourself

One-shot prompts often fail when faced with complex indirect injections or "system update" fabrications. This skill provides a systematic framework for input validation that treats data as untrusted by default, ensuring your agent never "absorbs" commands hidden in documents.

Use cases

• Protecting agents that summarize customer support tickets from malicious user instructions.
• Securing RAG pipelines where retrieved chunks might contain adversarial text.
• Preventing "refund" or "delete account" commands from being triggered by scraped reviews or emails.
• Scanning tool error messages and API responses for injected "helpful" instructions that attempt to bypass safety checks.

Known limitations

This is a logic-based firewall for prompt-based agents. It does not provide network-level protection or signature-based malware scanning for binary files.