Prompt Injection Defense skills for AI agents

Design the tool-permission model for an LLM agent so that compromise of the model has bounded blast radius. Covers per-tool risk classes, confirmation flows, capability scoping, and audit logging. Use when building agents with any tools that have real-world side effects.

Defend against prompt injection delivered via tool outputs — fetched webpages, retrieved documents, third-party API responses, RAG context. The attacks the user didn't author but the model still acts on. Use when building agents with tool access and any path through which untrusted content reaches the model.

Sanitize user input before passing it to the LLM to reduce injection attack surface. Covers content filtering, structural separation, prompt sandwiching, and the limits of input-side defenses. Use as one layer of an LLM application's defense in depth.

Recognize the categories of prompt injection attack — direct injection, indirect injection via tool output, jailbreaks, exfiltration, and the failure modes specific to LLM applications. Foundation for designing defenses. Use when building any LLM application that processes untrusted input or has tool access.