Update to Prompt Injection Security

{
  "name": "agent-tool-boundaries",
  "description": "Review AI agent tools, permissions, arguments, outputs, and action approvals for prompt-injection-driven misuse paths.",
  "included_files": [
    {
      "relative_path": "._SKILL.md",
      "size_in_bytes": 163
    }
  ],
  "skill_md_contents": "---\nname: agent-tool-boundaries\ndescription: Review AI agent tools, permissions, arguments, outputs, and action approvals for prompt-injection-driven misuse paths.\n---\n\n# Agent Tool Boundary Review\n\nUse when an LLM can call tools, APIs, databases, browsers, code execution, or workflow actions.\n\n## Review steps\n\n1. Inventory tools, descriptions, authentication scopes, accessible resources, side effects, input schemas, output sensitivity, and user confirmation boundaries.\n2. For each tool, ask whether attacker-controlled content can influence invocation, target, identifiers, query, body, recipient, or sequence.\n3. Check authorization in deterministic application logic rather than relying on the model's decision; verify tenant/user binding, allowlists, schemas, bounds, and server-side policy.\n4. Examine tool outputs as untrusted input. Check for secret minimization, provenance, cross-tenant exposure, and instruction-like output that could influence later steps.\n5. Recommend least privilege, read-only defaults, narrow capabilities, independent action validation, explicit user approval for consequential changes, idempotency, audit logging with redaction, and rollback controls.\n6. Design synthetic tests that prove denied operations remain denied even when context contains hostile instructions.\n\n## Boundaries\n\nDo not invoke tools against a live target or trigger side effects during a review. Do not expose tokens, credentials, hidden system prompts, or private records. Mark unknown enforcement as unverified rather than secure.\n"
}