indirect-prompt-injection

Name: indirect-prompt-injection
Availability: InStock
Author: Akshay

Label, filter, and isolate externally retrieved content to prevent indirect prompt injection.

4|Updated Apr 27, 2026

Search Tags:#security-audit #prompt-security #llm-safety #indirect-prompt-injection #retrieval-grounding #content-labeling

Ready to run

npx skills add https://github.com/maruakshay/mii-ai-security --skill indirect-prompt-injection

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: indirect-prompt-injection
Source: https://github.com/maruakshay/mii-ai-security/tree/main/skills/indirect-prompt-injection
Command: npx skills add https://github.com/maruakshay/mii-ai-security --skill indirect-prompt-injection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Indirect prompt injection occurs when content fetched from external sources can influence model behavior, potentially compromising system prompts or leaking sensitive instructions. This guide provides guardrails to label, filter, and isolate retrieved content so it cannot override trusted prompts or execution paths.

Core Features & Use Cases

External-content labeling and trust-scoping for fetched blocks (source, trust level, allowed use).
Injection-pattern filtering to detect role-claims, instruction overrides, and delimiter breakouts before content enters prompts.
Isolation and auditing that route retrieved data through a trusted/information-only channel and log suspicious activity for post-incident review.
Use Case: Protect a chat assistant that ingests tickets, web pages, or emails from altering its system prompts or escalation logic.

Quick Start

Enable the external-content guardrails in your retrieval pipeline and run a test with a poisoned content sample.

Frequently Asked Questions about indirect-prompt-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent indirect prompt injection from retrieved web pages and documents?▼

Prevent indirect prompt injection by labeling, filtering, and isolating externally retrieved content before it influences model prompts. Apply external-content trust-scoping, delimiter breakout detection, and strict retrieval-action separation to block instruction overrides.

How does external-content labeling secure LLM prompts during retrieval grounding?▼

External-content labeling secures retrieval grounding by tagging fetched blocks with source, trust level, and allowed use. This metadata routes retrieved data through a trusted information-only channel, preventing untrusted text from modifying execution paths.

What is the best way to filter role-claims and delimiter breakouts in fetched content?▼

The best way to filter role-claims and delimiter breakouts is using injection-pattern filtering on externally retrieved content. This detects instruction overrides and delimiter breakouts before content enters prompts, ensuring system prompts remain isolated from untrusted external data.

Can I audit suspicious content that attempts to alter chat assistant escalation logic?▼

Yes, you can audit suspicious content by implementing auditable logging that routes retrieved data through a trusted channel. This logs injection attempts from ingested tickets or emails for post-incident review, protecting escalation logic from malicious modifications.

Does this LLM safety approach work for chat assistants ingesting emails and support tickets?▼

Yes, this LLM safety approach works for chat assistants ingesting emails and support tickets. It isolates externally retrieved content using external-content labeling and strict separation of retrieval from action, preventing ingested tickets from altering system prompts.

When do I need strict separation of retrieval from action in LLM pipelines?▼

You need strict separation of retrieval from action when external content influences model behavior in LLM pipelines. If fetched web pages, documents, or tool outputs risk overriding trusted prompts, isolation prevents retrieved data from modifying execution paths.