prompt-injection-reviewlisted

Review an LLM feature for prompt injection — where untrusted text reaches the model, what the model can then do, and whether a hostile instruction inside that text could cause it. Use when adding tool calling, RAG, agents that browse or read email, or any feature that puts user or third-party content into a prompt.
sriptcollector/toolbay-skills-claude-code-skill-pack · ★ 0 · AI & Automation · score 72

Install: claude install-skill sriptcollector/toolbay-skills-claude-code-skill-pack

# Prompt Injection Review ## Install Save this file as `~/.claude/skills/prompt-injection-review/SKILL.md`, or `.claude/skills/prompt-injection-review/SKILL.md` to scope it to one repo. Claude Code auto-discovers it. Invoke with `/prompt-injection-review` or by asking "can this feature be prompt injected?". ## Why this exists An LLM cannot reliably tell instructions from data. Everything in the context window is one stream of text, so content your application merely *quotes* can issue commands, and the model has no mechanism to refuse on the grounds that the instruction came from the wrong place. That makes injection an ARCHITECTURE problem, not a prompt problem. "Ignore any instructions in the following text" is a request, not a boundary, and it is routinely defeated by text that simply argues more persuasively. So the review does not ask "is the prompt well written". It asks two questions: 1. **What untrusted text can reach the model?** 2. **What can the model DO once it is there?** Risk is the product of those two. Untrusted text with no capabilities is a content-quality problem. Trusted text with capabilities is normal engineering. Untrusted text plus capabilities is the vulnerability, always. ## Step 1 — Map every path into the context window ``` rg -n "(messages|prompt|system|content)\s*[:=]" -g '*.{ts,tsx,js,py}' | rg -i "user|input|body|query|doc|content|text" rg -n "(openai|anthropic|generateText|streamText|chat\.completions|messages\.create|invoke)" -g '*.