RepoAI
Browse MCPs

Indirect Injection Detection

100TrustedPre-approves tools

Identification of malicious instructions embedded within retrieved or uploaded documents.

What it does

Indirect Injection Detection changes how your assistant handles external data. By installing this, you equip your model to identify and flag unauthorized instructions hidden inside retrieved context, files, or web pages that it is asked to summarize or reference. It essentially turns your agent into a security filter that distinguishes between the content it is meant to process and hidden commands that attempt to hijack its core behavior.

This skill is for developers who want to minimize the risk of prompt manipulation when working with RAG, file uploads, or URL fetching. It provides a standardized method for evaluating whether your assistant is susceptible to external command injection, helping you identify if the model will mistakenly follow instructions buried inside a source document instead of just summarizing it.

When it earns its place

Reach for it when…

Apply this when your assistant interacts with data sourced from external knowledge bases, user-uploaded PDFs, or live web content. It is essential during the development and testing phases of an application where an agent is expected to follow instructions found within a data source, but must be prevented from executing malicious commands.

Look elsewhere when…

Do not use this for systems that operate exclusively on direct, trusted user input without any external data retrieval or document processing. It is not a replacement for backend authentication, API access control, or structural security measures, as it focuses specifically on the logic of prompt adherence rather than infrastructure-level defense.

What to say to use it

You never invoke a skill directly — the assistant picks it up when your request matches what it covers. These are the kinds of things that do that.

  • Check if the document content can trick the assistant
  • Identify if external context is hijacking the agent
  • Test if this file contains hidden instructions
  • Detect prompt injection in retrieved RAG data

Install it

Install for all your projects

Copy the skill directory into your personal skills folder. Claude picks it up on its own the next time your request matches what it does — there is nothing to enable.

bash
git clone --depth 1 --branch main https://github.com/Tencent/AI-Infra-Guard.git /tmp/AI-Infra-Guard
mkdir -p ~/.claude/skills
cp -r /tmp/AI-Infra-Guard/agent-scan/agent_scan/prompt/skills/indirect-injection-detection ~/.claude/skills/indirect-injection-detection

Install for one project only

Put it in the project's own skills folder instead, so it can be committed and shared with everyone working on that repository.

bash
cp -r /tmp/AI-Infra-Guard/agent-scan/agent_scan/prompt/skills/indirect-injection-detection .claude/skills/indirect-injection-detection

If a skill of the same name exists in both places, the personal one wins.

Installing on Claude.ai or through the API instead? The full guide covers every surface.

Pair it with an MCP server

Indirect Injection Detection changes how the work is done. These servers change what Claude can reach while doing it.

How skills and MCP servers differ →