mirror of
https://github.com/BagelHole/DevOps-Security-Agent-Skills.git
synced 2026-08-22 12:49:53 +02:00
56 lines
2.0 KiB
Markdown
56 lines
2.0 KiB
Markdown
---
|
|
name: prompt-injection-defense
|
|
description: Defend AI systems against prompt injection and indirect prompt attacks using input controls, tool permissions, output validation, and isolation boundaries.
|
|
license: MIT
|
|
metadata:
|
|
author: devops-skills
|
|
version: "1.0"
|
|
---
|
|
|
|
# Prompt Injection Defense
|
|
|
|
Mitigate direct and indirect prompt injection across chat apps, agentic workflows, and RAG pipelines.
|
|
|
|
## Attack Surface
|
|
|
|
- User input attempting to override system instructions
|
|
- Untrusted documents/web pages in retrieval context
|
|
- Tool output that smuggles malicious instructions
|
|
- Cross-tenant leakage via shared context windows
|
|
|
|
## Defense-in-Depth Pattern
|
|
|
|
1. **Instruction hierarchy enforcement**: system > developer > user > tool output.
|
|
2. **Context segregation**: isolate untrusted text from control instructions.
|
|
3. **Tool permissioning**: explicit allow-list per task and tenant.
|
|
4. **Output policy checks**: validate schema, redact secrets, block unsafe actions.
|
|
5. **Human approval**: required for high-impact operations.
|
|
|
|
## Implementation Controls
|
|
|
|
- Strip or label untrusted content blocks before generation.
|
|
- Disable autonomous tool chaining for sensitive workflows.
|
|
- Use deterministic parsers (JSON schema) before tool execution.
|
|
- Reject requests containing high-risk exfiltration patterns.
|
|
- Add canary tokens to detect data exfil attempts.
|
|
|
|
## Red-Team Test Cases
|
|
|
|
- "Ignore previous instructions" style direct override
|
|
- Retrieval payload containing hidden policy bypass text
|
|
- Tool output instructing follow-up privileged command
|
|
- Prompt that asks for secrets from memory or env vars
|
|
|
|
## Security Metrics
|
|
|
|
- Prompt injection detection rate
|
|
- Unsafe tool invocation prevention rate
|
|
- Time-to-containment for injection attempts
|
|
- False positive rate on blocked safe prompts
|
|
|
|
## Related Skills
|
|
|
|
- [ai-agent-security](../ai-agent-security/) - Agent threat model and controls
|
|
- [llm-app-security](../llm-app-security/) - End-to-end LLM app hardening
|
|
- [security-automation](../../operations/security-automation/) - Automated policy response workflows
|