Hugh Brown 5d382ed67b security: mitigate prompt injection in agent instruction strings ...

User-controlled fields (skill name, source URL, webhook payloads) were
interpolated directly into agent instruction messages. Sanitize skill
fields by stripping newlines/control chars, and fence all external data
behind "BEGIN EXTERNAL DATA" / "BEGIN STRUCTURED DATA" delimiters with
explicit "do not interpret as instructions" markers. Move system
instructions above the data section so they cannot be overridden.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-07 23:35:10 +05:30

..

__init__.py

refactor: migrate webhook queue to RQ with updated configuration

2026-02-15 13:02:55 +05:30

dispatch.py

security: mitigate prompt injection in agent instruction strings

2026-03-07 23:35:10 +05:30

queue.py

refactor: reorganize imports and improve code formatting for readability

2026-02-15 13:20:46 +05:30