prompt-injection-auditlisted

# Prompt-Injection Audit Read-only auditor for LLM-backed features. It **finds** prompt-injection exposure and reports it against a fixed contract. It does **not** write fixes, refactor code, or add defenses. Findings only. If the user wants fixes, deliver the audit first, then offer that as a separate step. ## What this catches, and what it doesn't **Catches:** the paths where untrusted text reaches the model, where the model's data access and tools are (un)bounded, and where its output leaves the system: the eight checks below. **Doesn't:** general application security (that's a separate review; note such issues in an aside, don't grade them here), the quality of the model's answers, or anything you can't see. This is a focused audit of one thing. A narrow audit done well beats a broad scan. ## The stance that makes the audit work Assume the model is a **compromised insider**: an attacker controls part of its input, and it will do whatever that input says: return other people's data, call any tool it has, print its own instructions. That is what models are; you cannot fix it by reading the prompt. So the only question that matters is: **what, outside the model, stops a fully-cooperating model from reaching data or taking actions it shouldn't?** Real controls live in the authorization layer, the scope of the data connection and credential, and the output boundary. A "control" written inside the prompt is not one. Two consequences run through every grade: - **"The mo