ai-prompt-injection-defense SKILL.md skillB
ai-prompt-injection-defense from muvon/octomind-tap is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add muvon/octomind-tap/ai-prompt-injection-defense@git:20261013.a69e0bbPins git:20261013.a69e0bb in mdr.lock. Pin the fingerprint instead.
- Audit grade
- B, 16 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- muvon/octomind-tap
- Path
skills/ai-prompt-injection-defense/SKILL.md- Versions recorded
- 3
- Latest version
- git:20261013.a69e0bb, committed Oct 13, 2026
- First version recorded
- May 21, 2026
- Size
- 19,388 bytes
- Repository stars
- 6
- License
- Apache-2.0
Operational playbook for defending LLM applications and agents against prompt injection (direct + indirect) and red-teaming them in 2026. Covers the OWASP Top 10 for LLM Applications (2026 edition, with 2025 ID mapping), the OWASP Top 10 for Agentic Applications (ASI01-ASI10), foundational research (Greshake et al., Many-Shot Jailbreaking, Crescendo), documented exploits (EchoLeak CVE-2025-32711, GitHub Copilot CVE-2025-53773, ForcedLeak, Slack AI), architectural defenses…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
## Overview Prompt injection is LLM01 in both the 2025 and 2026 editions of the [OWASP Top 10 for LLM Applications](https://genai.owasp.org/llm-top-10/). Indirect injection — payloads delivered via retrieved content, emails, web pages, file contents, tool outputs — drove the major documented AI exploits of 2024–2025: Slack AI (Aug 2024), EchoLeak / Microsoft 365 Copilot zero-click (CVE-2025-32711, CVSS 9.3), GitHub Copilot RCE (CVE-2025-53773), ForcedLeak in Salesforce Agentforce (CVSS 9.4, Sep 2025). It is unsolved at the model level, so the defense is architectural plus defense-in-depth: limit what any one session can do, separate instructions from data, constrain outputs, filter, scope tools, and validate downstream. The offense pattern is methodical red-teaming with documented payloads and OWASP mappings. Use this skill when auditing an LLM app for injection, designing defense layers, mapping OWASP risks, or building a red-team suite. Skip it for systems that don't process untrusted content — but verify carefully, because "untrusted" includes RAG corpora, user input, sub-agent outputs, and tool results from external services. ## Mental model …
Read the whole file at its exact version.
How to install
mdr add muvon/octomind-tap/ai-prompt-injection-defense@sha256:d1385d00ec3fccaaThe line at the top of this page pins the label git:20261013.a69e0bb, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_z5weatnmyyu6wach)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 3 versions of this file, between May 21, 2026 and Oct 13, 2026, about one every 72 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261013.a69e0bb latest | 2026-10-13 | a69e0bb | 19,388 B | B | view · diff |
| git:20260918.40e721d | 2026-09-18 | 40e721d | 20,542 B | B | view · diff |
| git:20260521.845154d | 2026-05-21 | 845154d | 20,546 B | B | view |
Audit of the latest version
- fail: No prompt-injection phrasing (matched: ignore previous instructions)
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (19388 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Starting a new one? Use a template for SKILL.md on mdpantry, which passes every one of these checks and says what to change in it.
Source
muvon/octomind-tap · 6 stars · license Apache-2.0 · pushed 2026-11-08 · branch master
API
GET https://markdownregistry.com/api/v1/artifacts/art_z5weatnmyyu6wach GET https://markdownregistry.com/api/v1/resolve?ref=muvon/octomind-tap/ai-prompt-injection-defense GET https://markdownregistry.com/api/v1/blob/d1385d00ec3fccaa4944b94f5d310d52aeb366a920c1b995fcf2126169ac4c36
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from muvon/octomind-tap
Every file in muvon/octomind-tap