LLM Indirect Prompt Injection & Untrusted Data Fencing Skill

Defend autonomous agents against indirect prompt injection in emails, web pages, and MCP tool outputs using XML data fencing, privilege separation, and hum

---
name: prompt-injection-defense
description: Defend autonomous agents against indirect prompt injection in emails, web pages, and MCP tool outputs using XML data fencing, privilege separation, and human approval gates. Use when working with Prompt Security, Untrusted Data Fencing, Tool Governance, Agent Safety.
triggers:
  - prompt injection defense
  - prompt security
  - untrusted data fencing
---

# LLM Indirect Prompt Injection & Untrusted Data Fencing Skill

## 1. When to Use This Skill
Load `skill-prompt-injection-defense` whenever an engineering or operations task involves **Prompt Security, Untrusted Data Fencing, Tool Governance, Agent Safety**. Specifically:
- Defend autonomous agents against indirect prompt injection in emails, web pages, and MCP tool outputs using XML data fencing, privilege separation, and human approval gates.
- Designing, reviewing, or debugging production configurations without guesswork or deprecated flags.
- Running deterministic pre-flight and post-execution verification checks before reporting completion.

## 2. Prerequisites & Required Environment
- **Target Stack:** Prompt Security, Untrusted Data Fencing, Tool Governance, Agent Safety
- **Permissions:** Read-only inspection by default; ask for explicit confirmation before executing destructive mutations or production deployments.
- **Reference Repository:** `https://simonwillison.net/tags/prompt-injection/`

## 3. Step-by-Step Execution Playbook
1. **Context & Configuration Discovery:**
   Inspect existing project manifests (`package.json`, `wrangler.jsonc`, schema files, or environment declarations) before proposing changes. Never overwrite existing bindings or credentials blindly.
2. **Deterministic Implementation:**
   Apply the canonical patterns for **Prompt Security**:
   - Enforce strict schema/type validation at every external boundary.
   - Include explicit error handling, structured logging, and idempotency keys on all mutating calls.
   - Keep secrets in environment variables or secret stores—never hardcode tokens in source files.
3. **Verification & Regression Gate:**
   Run the verification commands below and inspect both exit codes and output payloads before marking the task complete.

## 4. Reference Commands & CLI Workflow
```bash
npx lightstate inspect inbox-injection-guard
```

## 5. Edge Cases & Anti-Hallucination Guardrails
- **Zero Unverified Claims:** Never claim a deployment, migration, or API call succeeded without inspecting the command output or HTTP status code.
- **Rollback Readiness:** Always record the previous state or migration version so changes can be reverted cleanly if downstream health checks fail.

Synthesized Engineering Blueprint & Setup Guide