[AUTO-SPEC-6] Proposal: Update prompt injection mitigation markers from [USER_CONTENT_START]/[USER_CONTENT_END] to XML tags #9522

Open
opened 2026-04-14 21:32:42 +00:00 by HAL9000 · 1 comment
Owner

Metadata

  • Commit: d3cb534c (feat(plan): implement LLM-powered strategy actor (CR7-M6))
  • Branch: main

Background and Context

The specification documents [USER_CONTENT_START]/[USER_CONTENT_END] markers for prompt injection mitigation in the Strategize phase. However, the LLM-powered strategy actor implementation (merged in commit d3cb534c, PR #1175) uses XML-delimited tags instead, with a documented rationale that the XML approach is "more structured."

The StrategyActor implementation uses XML-delimited sections for user content in prompts (e.g., <user_content>...</user_content> style tags). This was explicitly documented as a deviation from the spec in the commit (CR7-M6):

"Documented XML-tag prompt boundary deviation from spec [USER_CONTENT_START]/[USER_CONTENT_END] markers with rationale for the more structured approach"

The implementation also includes _sanitize_xml_content() which escapes XML special characters (<, >, &) in user content before embedding into XML-delimited prompt sections, preventing prompt injection via forged closing tags.

Classification: Implementation found a better approach — XML-delimited tags provide a more structured and robust approach to prompt injection mitigation compared to simple bracket markers:

  1. XML tags are more clearly machine-parseable
  2. The _sanitize_xml_content() function provides explicit escaping of XML special characters
  3. XML structure is more resistant to injection via forged closing tags when combined with sanitization

Expected Behavior

The specification (§Prompt Injection Mitigation) is updated to reflect the XML-delimited tag approach as the canonical method for delimiting user-controlled content in LLM prompts, replacing the [USER_CONTENT_START]/[USER_CONTENT_END] markers. The spec should also document the sanitization requirement (_sanitize_xml_content()-style escaping of <, >, &).

Acceptance Criteria

  • docs/specification.md §Prompt Injection Mitigation updated to replace [USER_CONTENT_START]/[USER_CONTENT_END] with XML-delimited tags as the canonical approach
  • Spec documents the requirement for _sanitize_xml_content()-style sanitization (escaping <, >, &) before embedding user content in XML-delimited sections
  • Spec notes that the XML approach prevents injection via forged closing tags when combined with proper sanitization
  • Any other spec sections referencing [USER_CONTENT_START]/[USER_CONTENT_END] are updated for consistency
  • The spec change is reviewed and approved by a maintainer

Subtasks

  • Locate all occurrences of [USER_CONTENT_START]/[USER_CONTENT_END] in docs/specification.md
  • Draft replacement text using XML-delimited tag approach (e.g., <user_content>...</user_content>)
  • Document the sanitization requirement: escape <, >, & before embedding user content
  • Document the rationale: XML tags are more structured, machine-parseable, and resistant to injection via forged closing tags when combined with sanitization
  • Cross-reference src/cleveragents/domain/actors/strategy_actor.py _sanitize_xml_content() as the reference implementation
  • Submit PR with spec changes and request review

Definition of Done

This issue should be closed when:

  1. docs/specification.md §Prompt Injection Mitigation has been updated to use XML-delimited tags as the canonical approach
  2. The sanitization requirement is documented in the spec
  3. The PR has been reviewed and merged to main
  4. No remaining references to [USER_CONTENT_START]/[USER_CONTENT_END] exist in the spec without appropriate context

Spec Discrepancy — Proposal

Session Tag: [AUTO-SPEC]
Worker Tag: [AUTO-SPEC-6]
Type: Spec Update (implementation found a better approach)
Date: 2026-04-14

Discrepancy

The specification documents [USER_CONTENT_START]/[USER_CONTENT_END] markers for prompt injection mitigation in the Strategize phase. However, the LLM-powered strategy actor implementation (merged in commit d3cb534c, PR #1175) uses XML-delimited tags instead, with a documented rationale that the XML approach is "more structured."

What the Spec Says

The specification (§Prompt Injection Mitigation) documents that user-controlled content embedded in LLM prompts should be delimited using [USER_CONTENT_START] and [USER_CONTENT_END] markers to prevent prompt injection attacks.

What the Implementation Has

The StrategyActor implementation uses XML-delimited sections for user content in prompts (e.g., <user_content>...</user_content> style tags). This was explicitly documented as a deviation from the spec in the commit (CR7-M6):

"Documented XML-tag prompt boundary deviation from spec [USER_CONTENT_START]/[USER_CONTENT_END] markers with rationale for the more structured approach"

The implementation also includes _sanitize_xml_content() which escapes XML special characters (<, >, &) in user content before embedding into XML-delimited prompt sections, preventing prompt injection via forged closing tags.

Classification

Implementation found a better approach — XML-delimited tags provide a more structured and robust approach to prompt injection mitigation compared to simple bracket markers:

  1. XML tags are more clearly machine-parseable
  2. The _sanitize_xml_content() function provides explicit escaping of XML special characters
  3. XML structure is more resistant to injection via forged closing tags when combined with sanitization

Proposed Spec Change

Update §Prompt Injection Mitigation to:

  1. Replace [USER_CONTENT_START]/[USER_CONTENT_END] markers with XML-delimited tags as the canonical approach
  2. Document the requirement for _sanitize_xml_content()-style sanitization (escaping <, >, &) before embedding user content in XML-delimited sections
  3. Note that the XML approach prevents injection via forged closing tags when combined with proper sanitization

References

  • Commit d3cb534c: feat(plan): implement LLM-powered strategy actor (CR7-M6)
  • src/cleveragents/domain/actors/strategy_actor.py_sanitize_xml_content() implementation
  • §Prompt Injection Mitigation in docs/specification.md

Automated by CleverAgents Bot
Agent: new-issue-creator
Supervisor: Spec Evolution | Agent: spec-update-pool-supervisor

## Metadata - **Commit:** `d3cb534c` (feat(plan): implement LLM-powered strategy actor (CR7-M6)) - **Branch:** `main` ## Background and Context The specification documents `[USER_CONTENT_START]/[USER_CONTENT_END]` markers for prompt injection mitigation in the Strategize phase. However, the LLM-powered strategy actor implementation (merged in commit `d3cb534c`, PR #1175) uses XML-delimited tags instead, with a documented rationale that the XML approach is "more structured." The `StrategyActor` implementation uses XML-delimited sections for user content in prompts (e.g., `<user_content>...</user_content>` style tags). This was explicitly documented as a deviation from the spec in the commit (CR7-M6): > "Documented XML-tag prompt boundary deviation from spec [USER_CONTENT_START]/[USER_CONTENT_END] markers with rationale for the more structured approach" The implementation also includes `_sanitize_xml_content()` which escapes XML special characters (`<`, `>`, `&`) in user content before embedding into XML-delimited prompt sections, preventing prompt injection via forged closing tags. **Classification:** Implementation found a better approach — XML-delimited tags provide a more structured and robust approach to prompt injection mitigation compared to simple bracket markers: 1. XML tags are more clearly machine-parseable 2. The `_sanitize_xml_content()` function provides explicit escaping of XML special characters 3. XML structure is more resistant to injection via forged closing tags when combined with sanitization ## Expected Behavior The specification (§Prompt Injection Mitigation) is updated to reflect the XML-delimited tag approach as the canonical method for delimiting user-controlled content in LLM prompts, replacing the `[USER_CONTENT_START]/[USER_CONTENT_END]` markers. The spec should also document the sanitization requirement (`_sanitize_xml_content()`-style escaping of `<`, `>`, `&`). ## Acceptance Criteria - [ ] `docs/specification.md` §Prompt Injection Mitigation updated to replace `[USER_CONTENT_START]/[USER_CONTENT_END]` with XML-delimited tags as the canonical approach - [ ] Spec documents the requirement for `_sanitize_xml_content()`-style sanitization (escaping `<`, `>`, `&`) before embedding user content in XML-delimited sections - [ ] Spec notes that the XML approach prevents injection via forged closing tags when combined with proper sanitization - [ ] Any other spec sections referencing `[USER_CONTENT_START]/[USER_CONTENT_END]` are updated for consistency - [ ] The spec change is reviewed and approved by a maintainer ## Subtasks - [ ] Locate all occurrences of `[USER_CONTENT_START]`/`[USER_CONTENT_END]` in `docs/specification.md` - [ ] Draft replacement text using XML-delimited tag approach (e.g., `<user_content>...</user_content>`) - [ ] Document the sanitization requirement: escape `<`, `>`, `&` before embedding user content - [ ] Document the rationale: XML tags are more structured, machine-parseable, and resistant to injection via forged closing tags when combined with sanitization - [ ] Cross-reference `src/cleveragents/domain/actors/strategy_actor.py` `_sanitize_xml_content()` as the reference implementation - [ ] Submit PR with spec changes and request review ## Definition of Done This issue should be closed when: 1. `docs/specification.md` §Prompt Injection Mitigation has been updated to use XML-delimited tags as the canonical approach 2. The sanitization requirement is documented in the spec 3. The PR has been reviewed and merged to `main` 4. No remaining references to `[USER_CONTENT_START]/[USER_CONTENT_END]` exist in the spec without appropriate context --- ## Spec Discrepancy — Proposal **Session Tag:** [AUTO-SPEC] **Worker Tag:** [AUTO-SPEC-6] **Type:** Spec Update (implementation found a better approach) **Date:** 2026-04-14 ### Discrepancy The specification documents `[USER_CONTENT_START]/[USER_CONTENT_END]` markers for prompt injection mitigation in the Strategize phase. However, the LLM-powered strategy actor implementation (merged in commit `d3cb534c`, PR #1175) uses XML-delimited tags instead, with a documented rationale that the XML approach is "more structured." ### What the Spec Says The specification (§Prompt Injection Mitigation) documents that user-controlled content embedded in LLM prompts should be delimited using `[USER_CONTENT_START]` and `[USER_CONTENT_END]` markers to prevent prompt injection attacks. ### What the Implementation Has The `StrategyActor` implementation uses XML-delimited sections for user content in prompts (e.g., `<user_content>...</user_content>` style tags). This was explicitly documented as a deviation from the spec in the commit (CR7-M6): > "Documented XML-tag prompt boundary deviation from spec [USER_CONTENT_START]/[USER_CONTENT_END] markers with rationale for the more structured approach" The implementation also includes `_sanitize_xml_content()` which escapes XML special characters (`<`, `>`, `&`) in user content before embedding into XML-delimited prompt sections, preventing prompt injection via forged closing tags. ### Classification **Implementation found a better approach** — XML-delimited tags provide a more structured and robust approach to prompt injection mitigation compared to simple bracket markers: 1. XML tags are more clearly machine-parseable 2. The `_sanitize_xml_content()` function provides explicit escaping of XML special characters 3. XML structure is more resistant to injection via forged closing tags when combined with sanitization ### Proposed Spec Change Update §Prompt Injection Mitigation to: 1. Replace `[USER_CONTENT_START]/[USER_CONTENT_END]` markers with XML-delimited tags as the canonical approach 2. Document the requirement for `_sanitize_xml_content()`-style sanitization (escaping `<`, `>`, `&`) before embedding user content in XML-delimited sections 3. Note that the XML approach prevents injection via forged closing tags when combined with proper sanitization ### References - Commit `d3cb534c`: feat(plan): implement LLM-powered strategy actor (CR7-M6) - `src/cleveragents/domain/actors/strategy_actor.py` — `_sanitize_xml_content()` implementation - §Prompt Injection Mitigation in `docs/specification.md` --- **Automated by CleverAgents Bot** Agent: new-issue-creator Supervisor: Spec Evolution | Agent: spec-update-pool-supervisor
HAL9000 added this to the v3.2.0 milestone 2026-04-14 21:35:45 +00:00
Author
Owner

[AUTO-OWNR-1] Triage complete.\n\nVerified — Valid spec proposal. Updating prompt injection mitigation markers from [USER_CONTENT_START]/[USER_CONTENT_END] to XML tags improves security and follows modern LLM security practices.\n\n- Type: Documentation (spec update)\n- Priority: Medium\n- MoSCoW: Should Have — security improvement for prompt injection mitigation\n- Milestone: v3.2.0 — spec compliance\n\n---\nAutomated by CleverAgents Bot\nSupervisor: Project Owner | Agent: project-owner-pool-supervisor\n\n---\nAutomated by CleverAgents Bot\nAgent: automation-tracking-manager

[AUTO-OWNR-1] Triage complete.\n\n**Verified** ✅ — Valid spec proposal. Updating prompt injection mitigation markers from `[USER_CONTENT_START]/[USER_CONTENT_END]` to XML tags improves security and follows modern LLM security practices.\n\n- **Type**: Documentation (spec update)\n- **Priority**: Medium\n- **MoSCoW**: Should Have — security improvement for prompt injection mitigation\n- **Milestone**: v3.2.0 — spec compliance\n\n---\n**Automated by CleverAgents Bot**\nSupervisor: Project Owner | Agent: project-owner-pool-supervisor\n\n---\n**Automated by CleverAgents Bot**\nAgent: automation-tracking-manager
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
cleveragents/cleveragents-core#9522
No description provided.