defending-against-prompt-injectionlisted

Keep an agent from obeying instructions hidden in the content it reads. Covers placing fetched pages, emails, and API responses in tool_result blocks instead of the system prompt; wrapping that content as JSON with explicit source fields; labeling its provenance; screening tool output with a fast classifier before the agent acts; and stating an untrusted-content policy in the system prompt. Use this when someone builds an agent that reads the web, email, shared files, or any third-party text, asks how to stop indirect or cross-content prompt injection, or finds an agent following instructions buried in a fetched page. Trigger on "indirect prompt injection," "agent followed instructions in a web page," "untrusted tool output," and similar. This is content handling inside the context window; limiting the damage once an attack lands is environment containment (sandboxing-agentic-systems), and gating outbound commands is action gating.
Hoja-Solutions/agent-stdlib · ★ 1 · AI & Automation · score 72

Install: claude install-skill Hoja-Solutions/agent-stdlib

# Defending against prompt injection Source: [Mitigate jailbreaks and prompt injection](https://platform.claude.com/docs/en/test-and-evaluate/strengthen-guardrails/mitigate-jailbreaks) and [Building trustworthy agents](https://www.anthropic.com/research/trustworthy-agents). The sandboxing skill caps what an attack can reach; this skill keeps the model from obeying the attack in the first place. The two stack: one deterministic boundary around the agent, one discipline for how third-party text enters its context. An agent that reads outside text inherits a new attacker: whoever wrote the page, the email, or the API response it fetches. That text can carry instructions aimed at the model, and a helpful model follows them unless you arrange the context so it can tell your instructions from the data. The steps below lower the odds it confuses the two. ## Keep untrusted content in tool_result blocks Put every piece of third-party text in a `tool_result` block. Instruction-tuned models weight instructions inside a tool result below those in the system prompt, so a sentence that would hijack the agent from the system prompt carries far less weight there. The converse holds too: do not put your own instructions in a tool result, because the model discounts those as well. Send your instructions in a user turn after the result lands. ## Wrap the content as data Encode untrusted strings as JSON with explicit fields, such as `{"source": "inbound_email", "from": "...", "body": "..."