# Prompt Injection Defense

> prompt-injection-defense

- Skill: `ismael-joffroy-chandoutis/prompt-injection-defense` (Agent Skill)
- Install (CLI): `npx skillmds@latest add ismael-joffroy-chandoutis/prompt-injection-defense`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ismael-joffroy-chandoutis/prompt-injection-defense/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: ismael-joffroy-chandoutis (https://skillmd.com/u/ismael-joffroy-chandoutis)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ismael-joffroy-chandoutis/prompt-injection-defense

---


# prompt-injection-defense

## Validation Checklist

- [CRITICAL] **Missing Input Sanitization**
  - User input passed directly to LLM without sanitization.
  - Fix: Add input validation: await detector.detect(userInput)
- [CRITICAL] **RAG Content Without Sanitization**
  - Retrieved content passed to LLM without sanitization.
  - Fix: Sanitize retrieved documents before including in context
- [MEDIUM] **Verbose Injection Detection Error**
  - Error messages reveal injection detection details to attacker.
  - Fix: Return generic error: 'Request could not be processed'
- [MEDIUM] **Single Layer Injection Defense**
  - Single pattern-based injection check. Easily bypassed.
  - Fix: Implement multi-layer defense with semantic analysis and output monitoring
- [MEDIUM] **Missing Output Behavior Monitoring**
  - LLM output used without behavior monitoring.
  - Fix: Monitor output for signs of successful injection
- [CRITICAL] **Tool Calls Without Validation**
  - Tool calls executed without validation.
  - Fix: Validate tool calls against allowed list and check arguments
- [HIGH] **System Prompt Exposure Risk**
  - System prompt may be extractable via prompt injection.
  - Fix: Mark system prompt as sensitive, monitor for leakage
- [MEDIUM] **No Multi-Turn Context Analysis**
  - Messages added without multi-turn injection analysis.
  - Fix: Analyze full conversation context, not just latest message
- [HIGH] **External Content Without Isolation**
  - External content added to context without isolation markers.
  - Fix: Wrap external content with clear boundaries and untrusted labels
- [MEDIUM] **No Encoded Injection Detection**
  - Injection detection doesn't check for encoded payloads.
  - Fix: Add checks for Base64, URL encoding, Unicode homoglyphs
- [CRITICAL] **Unlimited Tool Access**
  - LLM has access to all tools without restriction.
  - Fix: Limit tools to minimum required for task