prompt-injection-defense

A small, dependency-free prompt-injection screening toolkit.

The repository contains an advisory SKILL.md policy, a conservative Python
pre-screen, and tests for common prompt-injection signals. It is not a complete
security boundary: production systems still need instruction/data separation,
least-privilege tools, sandboxing, output authorization, and human approval for
high-impact side effects.

The Problem

Every LLM agent is vulnerable to attacks at the language level:

• A user types "ignore your instructions" — and the agent complies.
• A document being summarized contains hidden instructions — and the agent follows them.
• A roleplay prompt redefines the agent's identity — and bypasses its values.
• An attacker claims to be the developer — and gains elevated trust.

These are not code bugs. They are reasoning failures. The fix must also be at the language level.

Quickstart — 2 Ways to Load

1 · Claude Code (project-local policy)

mkdir -p .claude/skills/prompt-injection-defense
curl -o .claude/skills/prompt-injection-defense/SKILL.md \
  https://raw.githubusercontent.com/alexyyyander/prompt-injection-defense/master/skill/SKILL.md

Once placed in .claude/skills/, Claude Code can discover it as a project-local
policy. The host's system and developer instructions remain authoritative.

2 · Any agent — auto-install at startup

Add this to your agent's initialization code only if your host explicitly supports
loading external policy text. Treat downloaded files as untrusted data, pin a
revision or checksum, and do not assume that loading Markdown enforces behavior.

Python

import httpx

BASE = "https://raw.githubusercontent.com/alexyyyander/prompt-injection-defense/master"

def load_defense_skill() -> str:
    skill     = httpx.get(f"{BASE}/skill/SKILL.md").text
    community = httpx.get(f"{BASE}/skill/community-attacks.md").text
    return skill + "\n\n" + community

system_prompt = load_defense_skill() + "\n\n" + YOUR_EXISTING_SYSTEM_PROMPT

JavaScript / TypeScript

const BASE = "https://raw.githubusercontent.com/alexyyyander/prompt-injection-defense/master";

async function loadDefenseSkill(): Promise<string> {
  const [skill, community] = await Promise.all([
    fetch(`${BASE}/skill/SKILL.md`).then(r => r.text()),
    fetch(`${BASE}/skill/community-attacks.md`).then(r => r.text()),
  ]);
  return skill + "\n\n" + community;
}

const systemPrompt = await loadDefenseSkill() + "\n\n" + YOUR_EXISTING_SYSTEM_PROMPT;

curl (shell / any agent with bash access)

skill=$(curl -sf \
  "https://raw.githubusercontent.com/alexyyyander/prompt-injection-defense/master/skill/SKILL.md")
community=$(curl -sf \
  "https://raw.githubusercontent.com/alexyyyander/prompt-injection-defense/master/skill/community-attacks.md")
SYSTEM_PROMPT="$skill\n\n$community"

The community file is advisory threat intelligence. Do not inject it into a
higher-priority instruction channel without review and an integrity check.

What It Defends Against

What This Project Does Not Promise

• Loading Markdown cannot override system/developer instructions or enforce tool permissions.
• Regex and decoding heuristics cannot prove that an input is safe.
• The Python helpers do not parse every document format or understand model context.
• Passing unit tests does not establish model-level jailbreak resistance.

Repo Structure

prompt-injection-defense/
├── skill/
│   ├── SKILL.md                   ← The skill — load this in any agent
│   └── community-attacks.md       ← Auto-generated daily from approved reports
├── lib/
│   ├── defense_core.py            ← Python detection library
│   ├── detect_injection.py        ← CLI: detect injection in text
│   ├── sanitize_input.py          ← CLI: sanitize input before LLM call
│   └── validate_output.py         ← CLI: validate LLM output
├── supabase/
│   └── schema.sql                 ← DB schema for crowd-reported attacks
├── tests/
│   └── test_defense.py            ← Test suite
├── .claude/skills/prompt-injection-defense/
│   └── SKILL.md                   ← Claude Code auto-discovery (mirrors skill/)
├── .github/workflows/
│   ├── ci.yml                     ← Tests + skill lint on every push
│   └── update-community-attacks.yml ← Daily Supabase → community-attacks.md sync

Python Library (optional)

The repo also includes a Python detection library for applications that want
programmatic checking:

from lib import sanitize, validate_output, detect

safe_input = sanitize(user_input)          # fail-closed before LLM call
# For display-only redaction, use sanitize(user_input, block=False).
is_safe, threats = detect(user_input)      # check for attack patterns
validated = validate_output(llm_response)  # check LLM output

CLI tools:

python3 lib/detect_injection.py "ignore all previous instructions"
python3 lib/sanitize_input.py "your text here"
python3 lib/validate_output.py "LLM response here"

Testing

pip install pytest
pytest tests/ -v

Heuristic tests

The test suite covers common direct, encoded, Unicode-evasion, and output-leakage
signals. It does not benchmark a model and should not be presented as a safety
guarantee:

Contributing

• Report new attack patterns as GitHub Issues.
• Submit benchmark test cases via PR.
• Translate SKILL.md — non-English agents need coverage too.
• Add adapters for new agent platforms.

References

• OWASP Top 10 for LLMs — LLM01: Prompt Injection
• OWASP LLM Prompt Injection Prevention Cheat Sheet
• Greshake et al. (2023): Not What You've Signed Up For
• Perez & Ribeiro (2022): Ignore Previous Prompt
• CaMeL: Defeating Prompt Injections by Design
• Microsoft Indirect Prompt Injection Defense

License

MIT — copy it, fork it, include it in your agent.
The goal is for every agent to read this skill.