prompt-injection-shield

该 Skill 提供本地 Python CLI，在网页、邮件、工具返回或文档内容进入上下文前，用中英文规则和启发式检测忽略指令、角色劫持、越狱、DAN 及索要系统提示等特征，并给出风险分、命中规则与丢弃/隔离/沙箱建议。实际采集、拦截和沙箱执行未包含，检测准确率证据未提供。

zhaoxinghua09-cell

热度 63.04

最近更新 2026-10-17 07:41:18

分类：安全依赖：代码执行 / 读写文件应用场景：自动化脚本 / 数据处理 / 工作流

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add prompt-injection-shield

Metadata

name: prompt-injection-shield
title: Prompt Injection Shield
slug: prompt-injection-shield
display_name: 提示注入防护
display_name_en: Prompt Injection Shield
version: 1.0.1
agent_created: true
author: SynomosAI
license: MIT
allowed-tools: Read, Glob, Grep, Bash, WebFetch, WebSearch
category: security
platforms: ["windows","macos","linux","cli"]
platform_compatibility: ["windows","macos","linux"]
copyright: SynomosAI
description: 提示注入防护 — 在不可信内容进上下文之前先扫描：中英双语文式库（忽略指令/角色劫持/越狱/DAN/索要系统提示）+ 启发式 + 沙箱规则，输出风险分·命中规则·处置建议。
description_zh: 在不可信内容进上下文前先扫描：中英双语文式库（忽略指令/角色劫持/越狱/DAN/索要系统提示）+启发式+沙箱规则，输出风险分、命中规则与处置建议（丢弃/隔离/沙箱）。
description_en: Scan untrusted content (web pages, emails, tool returns, retrieved documents) for hidden instructions before it enters context: bilingual patterns for overrides, hijacks, jailbreaks and DAN, plus heuristics and sandbox rules; outputs a risk score, matched rules and disposition (drop/isolate/sandbox).
classification: {"skillhub":["security-compliance","prompt-security","content-safety"],"clawhub":["development","data-analytics","search"],"iso_25010":["Security"]}
read_when: ["要把外部内容（网页/邮件/工具返回/检索块/上传文件）塞进 AI 上下文","内容来源不可信或未经审核","出现「AI 好像被内容带偏/执行了奇怪指令」的征兆","用户问「怎么防止提示注入」「system prompt 会不会泄露」"]
risk_tier: medium
risk_rationale: 调用 API/读写文件/本地执行，最小权限，密钥走 Secret；若实际涉对外代执行(push/发布/发送/上架)须人工复评，改 high 并走负责人批准。
tags: ["prompt-injection-shield","提示注入","越狱","内容安全","沙箱","security-compliance"]
ai_protocol: true
spec: usk/1.0
interface: {"type":"cli","entry_point":"scripts/prompt_injection_scan.py","runtime":"python3","call_pattern":"args"}
output_schema: {"stdout":"structured risk report (score / matched rules / disposition)","exit_code":"rc=0 ok / rc=1 warning / rc=2 bad input"}
changelog: 1.0.1: Bilingual rewrite (EN-first); read_when kept; risk_rationale ref neutralized; 1.0.0 initial

凡自治之物 · LGD 治理学 · 创造术家族｜评测协议：skill-quality-gate

English

Prompt Injection Shield

When to use

Before data ingestion: when web pages, emails, tool returns, or uploaded documents are about to be fed to the AI, pre-scan before they enter context.
Prevent instruction hijack: detect "ignore previous instructions", "you are a new AI", jailbreak or system-prompt-leak attempts.
As a pre-stage to release-gate, combining desens-scan for double-checking so untrusted content cannot pollute context.

How to use

Run python scripts/prompt_injection_scan.py.
Pass the text to scan via --input and set the scan mode via --mode safe/aggressive.
Output includes risk score, matched rules, and disposition advice; read the returned JSON for downstream decisions.

Workflow

Submit content to the bilingual pattern + heuristic scanner.
The engine identifies jailbreak, DAN, role hijack, and system-prompt-leak traits and checks sandbox rules.
Score the overall risk; record matched rules and decide whether to trigger desensitization or blocking.
Produce a disposition (drop/isolate/sandbox), reusing desens-scan and release-gate logic.
The front-end acts on the score: block, isolate, or run in a safe sandbox.

Evidence & safety

Evidence: TBD; Version: 1.0.1; Security: no independent scan (TBD).

中文

提示注入防护

何时用

数据接入前扫描：网页抓取、邮件、工具返回值或上传文档喂给 AI 前做安全预审。
防止指令劫持：检测「忽略之前指令」「你是新 AI」等触发词，防越狱或泄露系统提示。
作为 release-gate 前置环节，结合 desens-scan 双重校验，防不可信内容污染上下文。

用法

运行 python scripts/prompt_injection_scan.py。
--input 传入待扫描文本，--mode safe/aggressive 指定模式。
输出含风险分、命中规则详情与处置建议，可读返回 JSON 做后续决策。

流程

提交内容到双语文式库+启发式扫描入口 → 识别越狱/DAN/角色劫持/系统提示泄露特征并关联沙箱规则 → 计算风险分并记录命中规则 → 生成处置建议（丢弃/隔离/沙箱）→ 前端按分拦截/隔离/沙箱运行。

证据与安全声明

证据：TBD；版本：1.0.1；安全：未做独立安全扫描（TBD）。