Map every instruction channel
List system and user instructions, skill files, memory, project rules, webpages, email, documents, API responses, tool output, and generated files. Label which channels are trusted instructions and which are untrusted data.
The skill should explicitly tell the agent that instructions inside source material do not override higher-authority rules or authorize tool use.
- Trusted instruction sources
- Untrusted content sources
- Tool-returned text
- Generated or cached content
Constrain tools and data flow
Use read-only tools when possible, allowlist required hosts, validate filenames and destinations, and avoid shell interpolation with untrusted text. Keep credentials outside prompts and generated files.
For research and document workflows, preserve citations and sanitize output before it becomes a downstream instruction source. A quoted attack should remain quoted data.
- Least-privilege tools
- Destination validation
- Host allowlists
- Output sanitization
Build adversarial acceptance tests
Create fixtures that contain plausible malicious instructions, fake approval, encoded text, conflicting sources, and requests to expose keys. Verify the agent ignores the attack, completes the legitimate task, and reports the attempted manipulation.
Repeat the test after any change to tools, model, adapter, or source pipeline. Prompt-injection resistance is an operating property, not a one-time statement in a sales page.
- Direct injection
- Indirect injection
- Fake authorization
- Tool-output injection
Build the controlled foundation first.
Agent Ready turns these principles into four working documents before it asks you to automate anything.
Get Agent Ready Free