Indirect Prompt Injection Defense

**Judgement:** A strong, practical first-line defense against common indirect prompt-injection patterns in external content, suitable as a security layer in LLM applications but **not** sufficient as the only safeguard against sophisticated attacks. **What it does well** - Identifies many real-world injection techniques: direct instruction phrases (e.g., “ignore previous instructions”, “you are now…”), goal hijacking, attempts at data exfiltration, and emotional/social-engineering language. - Accounts for some common obfuscation tricks (base64, homoglyphs, zero-width characters, simple ciphers, hidden HTML) that can bypass naive string checks. - Provides a clear operational protocol (isolate → scan → preserve original task → quote, don’t execute → confirm with user) and a response template for safely surfacing suspicious content. - Offers CLI scripts and exit codes that make integration into existing pipelines or guardrails straightforward. **Key risks / limitations** - **Heuristic-based:** Regex and pattern checks can miss novel or carefully obfuscated injection strategies and may generate false positives on benign but directive-sounding text. - **Context-insensitive:** It cannot fully reason about complex task context, system prompts, or cross-document attacks; it should be combined with higher-level policy enforcement and sandboxing. - **Coverage bounds:** While it mentions 20+ patterns and various encodings, there is no guarantee it covers the full spectrum of emerging prompt injection vectors or multi-step chained attacks. - **Over-reliance risk:** Using this as the sole defense could create a false sense of security; it should be part of a layered security architecture (system prompt design, tool restrictions, output filters). **Recommended use scenarios** - As a **mandatory pre-processing step** for any LLM feature that ingests untrusted external text: web browsing, email processing, document assistants, customer support agents, or social media summarizers. - As a **CI/security gate** for repositories, logs, or knowledge bases that will later be indexed and queried by LLMs. - In **agentic systems** that execute actions based on read content, to ensure that instructions embedded in that content are never treated as authoritative without explicit user confirmation. Overall, this skill is well-suited as a practical, easy-to-integrate guardrail for indirect prompt injection, best used in combination with additional security measures and robust system-level policies.