{
  "id": "skl_fe4d001590fd",
  "slug": "skill-prompt-injection-defense",
  "asset_type": "skill",
  "name": "LLM Indirect Prompt Injection & Untrusted Data Fencing Skill",
  "tagline": "Defend autonomous agents against indirect prompt injection in emails, web pages, and MCP tool outputs using XML data fencing, privilege separation, and hum",
  "description_md": "### Overview & Capability Scope\n**LLM Indirect Prompt Injection & Untrusted Data Fencing Skill** (`skill-prompt-injection-defense`) is a verified, portable `SKILL.md` playbook curated with **@simonw** for Grok Bot (`x.ai/bot/`), Claude Code (`~/.claude/skills/`), and Cursor (`.cursor/skills/`).\n\nDefend autonomous agents against indirect prompt injection in emails, web pages, and MCP tool outputs using XML data fencing, privilege separation, and human approval gates.\n\n### Required Stack & Tooling\n- **Primary Stack:** Prompt Security, Untrusted Data Fencing, Tool Governance, Agent Safety\n- **Category:** `security-ops`\n- **Source & Reference:** [https://simonwillison.net/tags/prompt-injection/](https://simonwillison.net/tags/prompt-injection/)\n\n### Quickstart Installation\nInstall this `SKILL.md` playbook directly into your agent workspace:\n```bash\nnpx lightstate install skill-prompt-injection-defense\n```\nOr copy the complete `SKILL.md` specification below into `.cursor/skills/skill-prompt-injection-defense/SKILL.md` or `~/.claude/skills/skill-prompt-injection-defense/SKILL.md`.\n\n### Verification Commands\n```bash\nnpx lightstate inspect inbox-injection-guard\n```\n",
  "primary_category": "security-ops",
  "categories_json": "[\"security-ops\", \"skills\"]",
  "tags_json": "[\"prompt-security\", \"untrusted-data-fencing\", \"tool-governance\", \"agent-safety\", \"skill-md\", \"security-ops\"]",
  "compatible_agents_json": "[\"grok-bot\", \"claude-code\", \"cursor\"]",
  "integrations_json": "[\"Prompt Security\", \"Untrusted Data Fencing\", \"Tool Governance\"]",
  "includes_json": "[]",
  "safety_level": "Read-Only / Ask-First",
  "safety_summary": "Verified capability blueprint by @simonw.",
  "share_url": "",
  "deep_link_uri": "",
  "mcp_endpoint": "",
  "mcp_transport": "http",
  "install_command": "npx lightstate install skill-prompt-injection-defense",
  "skill_markdown": "---\nname: prompt-injection-defense\ndescription: Defend autonomous agents against indirect prompt injection in emails, web pages, and MCP tool outputs using XML data fencing, privilege separation, and human approval gates. Use when working with Prompt Security, Untrusted Data Fencing, Tool Governance, Agent Safety.\ntriggers:\n  - prompt injection defense\n  - prompt security\n  - untrusted data fencing\n---\n\n# LLM Indirect Prompt Injection & Untrusted Data Fencing Skill\n\n## 1. When to Use This Skill\nLoad `skill-prompt-injection-defense` whenever an engineering or operations task involves **Prompt Security, Untrusted Data Fencing, Tool Governance, Agent Safety**. Specifically:\n- Defend autonomous agents against indirect prompt injection in emails, web pages, and MCP tool outputs using XML data fencing, privilege separation, and human approval gates.\n- Designing, reviewing, or debugging production configurations without guesswork or deprecated flags.\n- Running deterministic pre-flight and post-execution verification checks before reporting completion.\n\n## 2. Prerequisites & Required Environment\n- **Target Stack:** Prompt Security, Untrusted Data Fencing, Tool Governance, Agent Safety\n- **Permissions:** Read-only inspection by default; ask for explicit confirmation before executing destructive mutations or production deployments.\n- **Reference Repository:** `https://simonwillison.net/tags/prompt-injection/`\n\n## 3. Step-by-Step Execution Playbook\n1. **Context & Configuration Discovery:**\n   Inspect existing project manifests (`package.json`, `wrangler.jsonc`, schema files, or environment declarations) before proposing changes. Never overwrite existing bindings or credentials blindly.\n2. **Deterministic Implementation:**\n   Apply the canonical patterns for **Prompt Security**:\n   - Enforce strict schema/type validation at every external boundary.\n   - Include explicit error handling, structured logging, and idempotency keys on all mutating calls.\n   - Keep secrets in environment variables or secret stores—never hardcode tokens in source files.\n3. **Verification & Regression Gate:**\n   Run the verification commands below and inspect both exit codes and output payloads before marking the task complete.\n\n## 4. Reference Commands & CLI Workflow\n```bash\nnpx lightstate inspect inbox-injection-guard\n```\n\n## 5. Edge Cases & Anti-Hallucination Guardrails\n- **Zero Unverified Claims:** Never claim a deployment, migration, or API call succeeded without inspecting the command output or HTTP status code.\n- **Rollback Readiness:** Always record the previous state or migration version so changes can be reverted cleanly if downstream health checks fail.\n",
  "starter_prompt": "Load the LLM Indirect Prompt Injection & Untrusted Data Fencing Skill (skill-prompt-injection-defense) playbook. First inspect our current configuration and codebase for Prompt Security, Untrusted Data Fencing, Tool Governance, Agent Safety. Then propose a concrete, step-by-step implementation plan following the skill-prompt-injection-defense guardrails, run the non-destructive verification commands (npx lightstate inspect inbox-injection-guard), and summarize any findings, risks, or required environment variables before making production changes.",
  "project_url": "https://simonwillison.net/tags/prompt-injection/",
  "repo_url": "https://simonwillison.net/tags/prompt-injection/",
  "creator_handle": "simonw",
  "creator_name": "Simon Willison (@simonw)",
  "creator_avatar_url": null,
  "creator_url": "https://x.com/simonw",
  "creator_platform": "x",
  "creator_cal_url": null,
  "claimed_by_user_id": null,
  "scouted_by_handle": null,
  "source_url": "https://simonwillison.net/tags/prompt-injection/",
  "source_tweet_id": null,
  "source_origin": "certified_builder",
  "source_posted_at": null,
  "x_likes": 320,
  "x_bookmarks": 715,
  "x_retweets": 178,
  "x_views": 4480,
  "human_upvotes": 320,
  "human_installs": 320,
  "bot_pulls": 715,
  "pulse_score": 93,
  "gravity_rank_score": 2585,
  "is_featured": 0,
  "is_verified": 1,
  "is_sponsored": 0,
  "sponsor_tier": "free",
  "sponsor_label": "",
  "sponsor_cta_url": "",
  "sponsor_expires_at": null,
  "commercial_intent_score": 0,
  "status": "active",
  "created_at": "2026-10-24T20:00:00Z",
  "updated_at": "2026-10-24T20:00:00Z",
  "verified_at": null,
  "primitive": "skill",
  "title": "LLM Indirect Prompt Injection & Untrusted Data Fencing Skill",
  "description": "Defend autonomous agents against indirect prompt injection in emails, web pages, and MCP tool outputs using XML data fencing, privilege separation, and hum",
  "category": "security-ops",
  "tags": "[\"prompt-security\", \"untrusted-data-fencing\", \"tool-governance\", \"agent-safety\", \"skill-md\", \"security-ops\"]",
  "agent_compatibility": "[\"grok-bot\", \"claude-code\", \"cursor\"]",
  "author_handle": "simonw",
  "author_name": "Simon Willison (@simonw)",
  "author_avatar": null,
  "source_tweet_url": "https://simonwillison.net/tags/prompt-injection/",
  "github_url": "https://simonwillison.net/tags/prompt-injection/",
  "external_url": "https://simonwillison.net/tags/prompt-injection/",
  "upvotes_count": 320,
  "installs_count": 320
}