Overview — Prompt-Injection Defense Kit

Practical, testable defenses against prompt injection — the #1 security issue

for LLM apps and agents. When your app feeds untrusted text (web pages, documents,

emails, tool outputs) into a model, that text can carry instructions that hijack

your agent. This kit gives you layered, code-level mitigations and a battery of

attack tests to prove they work.

Honest framing: prompt injection is not "solved". No single trick makes a model

immune. Defense is layered risk reduction — this kit implements the layers

that measurably help and shows what each does and does not stop.

The layers (defense in depth)

1. Input isolation — wrap untrusted content in delimiters and tell the model to

treat it as data, never as instructions. src/isolate.ts.

2. Injection heuristics — flag classic override phrases ("ignore previous

instructions", "you are now…", fake system tags) before/after the model.

src/detect.ts.

3. Output allow-listing — constrain what the model is allowed to *do* with a

strict output schema, so an injected instruction can't invent a new action.

4. Tool/action gating — never let model output directly trigger a

side-effecting tool without a policy check + human/owner approval for the

dangerous ones. src/gate.ts.

5. Least privilege — the agent's tools/keys are scoped so a successful

injection can't do much (the real backstop).

What's inside

• src/isolate.ts — safe wrapping of untrusted content + a hardened system preamble.
• src/detect.ts — heuristic injection detector (patterns + scoring).
• src/gate.ts — action gate: policy-check model-proposed actions before executing.
• test/attacks.test.ts — 20+ known injection payloads asserting they're caught

or neutralized (Vitest).

• ATTACK-CATALOG.md — the injection techniques, what each layer does about them.

What this stops (and what it doesn't)

• Stops / reduces: naive "ignore instructions" overrides, fake system prompts,

data-exfil-via-output when output is schema-constrained, unauthorized tool calls

(gated).

• Does NOT fully stop: a determined adversary + a capable model can still be

steered. That's why layer 5 (least privilege) is non-negotiable — assume some

injections succeed and cap the blast radius.

Requirements

Node 18+, TypeScript 5+.