defensive-prompt-injection

defensive-prompt-injection

Defense-in-depth for Claude Code against prompt injection delivered through ingested content. Read/WebFetch/WebSearch/MCP outputs are treated as data, never as instructions.

Défense en profondeur pour Claude Code contre l'injection de prompt via du contenu ingéré. Les sorties de Read/WebFetch/WebSearch/MCP sont traitées comme des données, jamais comme des instructions.

⚠️ Experimental — v0.1.0. This plugin is an early proof-of-concept. It raises the bar against prompt injection but does not make Claude Code immune. Treat it as a defense-in-depth layer, not a guarantee. Stay vigilant: review what the agent is about to do before approving any side-effect action, verify hook activation in fresh sessions, and don't rely on the plugin alone to protect against high-stakes attacks. New attack patterns emerge constantly — if you discover one this plugin misses, please open an issue with a fixture.

💸 Token cost notice. This plugin adds a small <system-reminder> (~100 tokens) to your context after every Read / WebFetch / WebSearch / mcp__* call. When the quarantine-reader subagent fires on a high-risk source, that's an additional subagent invocation with its own input/output token cost. On a Claude Pro/Max subscription the impact is invisible (within plan limits). If you use Claude Code via a pay-per-token API key, expect a small but real increase in your token bill — proportional to how many files/URLs you ingest per session. The defense is cheap, but it is not free.

Why

Claude Code agents routinely read PDFs, HTML pages, search results, and MCP tool outputs. Any of those can carry instructions crafted to subvert the agent: exfiltrate credentials, run destructive commands, poison memory, hijack other skills. Without a defensive layer, an injection in page 347 of a PDF can change agent behavior hours later.

Anthropic's Acceptable Use Policy (effective 2025-09-15) explicitly names prompt injection as a prohibited form of platform abuse and confirms that "detection and monitoring" are applied to enforce it. In practice we observe these upstream safeguards blocking flagrant payloads before they reach the agent. This plugin is complementary: it runs inside the session and gates the patterns that slip past those upstream safeguards — homoglyphs, invisible Unicode tag chars, conditional deferred triggers, memory and skill poisoning, confused-deputy blockquotes, polyglot encodings, misleading markdown links. It reasons about the origin of a proposed action (user vs. ingested content), which platform-level filters generally cannot do.

This plugin installs a defense in three layers, each independent.

Architecture

┌─────────────────────────────────────────────────────────┐
│ Agent                                                   │
│                                                         │
│  Tool call ──► Read / WebFetch / WebSearch / mcp__*     │
│                       │                                 │
│                       ▼                                 │
│   Layer 1 ─── PostToolUse hook                          │
│               injects <system-reminder>                 │
│                       │                                 │
│                       ▼                                 │
│   Layer 2 ─── trust-boundary skill                      │
│               3 principles + decision flow              │
│                       │                                 │
│                       ▼                                 │
│   Layer 3 ─── quarantine-reader subagent                │
│               (high-risk or large sources)              │
└─────────────────────────────────────────────────────────┘

• Layer 1 (deterministic): a hook fires on every tool match and injects a short reminder. Cannot be skipped by the model.
• Layer 2 (judgment): a skill encoding three general principles — data vs instruction, action-gating for side effects, operational opacity about the rules.
• Layer 3 (isolation): a subagent that reads untrusted content in a separate context and returns a sanitized summary, so the raw injection never reaches the main agent.

Auditing the hook scripts

The hook is the only piece of executable code in this plugin — the rest is markdown (skill, subagent prompt, README) and JSON config. Including shell scripts inside a defensive plugin deserves scrutiny, so both variants are designed to be auditable in under two minutes:

• post-tool-use.sh — ~48 lines, runs on Linux/macOS
• post-tool-use.ps1 — runs on Windows

What they do: