From 3780be48bbe8745341c45563815de5204574b46b Mon Sep 17 00:00:00 2001 From: CleverThis Date: Tue, 14 Apr 2026 23:12:39 +0000 Subject: [PATCH] docs(spec): update prompt injection mitigation to use XML-delimited tags Replace [USER_CONTENT_START]/[USER_CONTENT_END] bracket markers with XML-delimited tags as the canonical approach for prompt injection mitigation in the Strategize phase. Document the sanitization requirement: escape <, >, & before embedding user content in XML-delimited sections. Note that XML tags prevent injection via forged closing tags when combined with proper sanitization. Cross-reference _sanitize_xml_content() as the reference implementation. Closes #9522 --- docs/specification.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/specification.md b/docs/specification.md index e16c06ad1..0fee3926a 100644 --- a/docs/specification.md +++ b/docs/specification.md @@ -46246,7 +46246,7 @@ In server mode, where user-provided content may flow into LLM prompts, CleverAge 1. **Input sanitization**: User-provided text in action arguments, invariant text, and session prompts is sanitized before inclusion in LLM prompts. HTML entities, control characters, and known injection patterns are escaped or rejected. -2. **Prompt boundary markers**: System prompts and user content are separated by clear boundary markers that the LLM is instructed to recognize. The system prompt explicitly states that content between `[USER_CONTENT_START]` and `[USER_CONTENT_END]` markers is user-provided and should not be treated as system instructions. +2. **Prompt boundary markers**: System prompts wrap user content inside XML-delimited sections (for example, `...`). All user-supplied text MUST be sanitized by escaping `<`, `>`, and `&` before embedding it in the XML wrapper; `_sanitize_xml_content()` provides the reference implementation. Combining the XML container with sanitization prevents prompt injection via forged closing tags. 3. **Output validation**: LLM outputs that are used as tool invocations are validated against the tool's JSON Schema before execution. This prevents the LLM from being tricked into invoking tools with malicious parameters. -- 2.52.0