34 lines
996 B
Markdown
34 lines
996 B
Markdown
# Prompt Injection And Tool Boundary Checklist
|
|
|
|
## Map These Layers Explicitly
|
|
|
|
- System and developer instructions
|
|
- User request
|
|
- Retrieved chunks or documents
|
|
- Memory or summaries
|
|
- Planner draft or chain-of-thought proxy artifacts
|
|
- Executor or tool adapter
|
|
- Final tool invocation and side effect
|
|
|
|
## Minimal Proof Chain
|
|
|
|
Use the smallest chain that proves the bug:
|
|
|
|
1. Untrusted content enters context
|
|
2. Model-visible instruction boundary changes
|
|
3. Planner or executor behavior drifts
|
|
4. Tool call or secret access changes
|
|
5. Side effect becomes observable
|
|
|
|
## Evidence To Keep
|
|
|
|
- One compact block for the malicious chunk or prompt
|
|
- One compact block for planner drift or intermediate rewrite
|
|
- One compact block for final tool args and side effect
|
|
|
|
## Common Pitfalls
|
|
|
|
- Treating a malicious string as proof without a side effect
|
|
- Mixing several injection variants before one minimal chain is proven
|
|
- Forgetting to separate retrieval contamination from executor normalization bugs
|