prompt-injection-guardlisted

# prompt-injection-guard Pre-filter for untrusted web content. Indirect prompt injection from fetched pages is **OWASP LLM01:2025** — the top LLM risk for three years running. Active CVEs include GitHub Copilot (CVSS 9.6) and Cursor (CVSS 9.8). January 2026 research demonstrated 5 crafted documents can manipulate a RAG agent's responses 90% of the time. **Every skill in this toolkit that fetches arbitrary URLs must run their content through this guard before passing it to any downstream LLM call.** ## When to use - `source-fetcher` calls this on the markdown body before returning. - Any skill ingesting RSS/Atom item bodies, podcast show notes, YouTube descriptions, or newsletter posts. - Any skill reading files from `_inbox/<agent-id>/` before promoting (those staged writes may themselves contain content originally fetched from the web). - Any skill that incorporates third-party docs into a prompt (e.g., a vendor's data sheet). ## When NOT to use - Trusted user input typed at the CLI. - Content already in `_meta/`, `decisions/`, `insights/`, `facts/`, `projects/`, or `people/` (curated, durable). - The user's own files in this repo. ## Input Plain markdown or text. Optional context: `source_url`, `source_tier`, `fetched_at` — these help calibrate verdict severity. ## Output shape ```json { "verdict": "clean | quarantined | suspicious", "clean_content": "<the content with quarantine blocks applied>", "findings": [ { "pattern": "instruction-override",