Security / Prompt injection

How to Audit Agent Skills for Prompt Injection

Prompt injection happens when untrusted content tries to steer the agent as if it were an authorized instruction. A skill audit must inspect both the written procedure and every place external content enters the workflow.

01

Map every instruction channel

List system and user instructions, skill files, memory, project rules, webpages, email, documents, API responses, tool output, and generated files. Label which channels are trusted instructions and which are untrusted data.

The skill should explicitly tell the agent that instructions inside source material do not override higher-authority rules or authorize tool use.

  • Trusted instruction sources
  • Untrusted content sources
  • Tool-returned text
  • Generated or cached content
02

Search for authority escalation

Look for instructions that ask the agent to reveal secrets, change policy, disable logging, skip approval, download remote code, alter memory, or contact an external party.

Also inspect indirect routes, such as a webpage telling the agent to edit a configuration file that later changes behavior. Do not assume Markdown is safe because it is not executable by itself.

  • Secret extraction
  • Approval bypass
  • Remote code or dependencies
  • Persistence and memory changes
03

Constrain tools and data flow

Use read-only tools when possible, allowlist required hosts, validate filenames and destinations, and avoid shell interpolation with untrusted text. Keep credentials outside prompts and generated files.

For research and document workflows, preserve citations and sanitize output before it becomes a downstream instruction source. A quoted attack should remain quoted data.

  • Least-privilege tools
  • Destination validation
  • Host allowlists
  • Output sanitization
04

Build adversarial acceptance tests

Create fixtures that contain plausible malicious instructions, fake approval, encoded text, conflicting sources, and requests to expose keys. Verify the agent ignores the attack, completes the legitimate task, and reports the attempted manipulation.

Repeat the test after any change to tools, model, adapter, or source pipeline. Prompt-injection resistance is an operating property, not a one-time statement in a sales page.

  • Direct injection
  • Indirect injection
  • Fake authorization
  • Tool-output injection
Put it to work

Build the controlled foundation first.

Agent Ready turns these principles into four working documents before it asks you to automate anything.

Get Agent Ready Free
Continue the field manual

Related guides