[Skill Upgrade]: security/prompt_injection_firewall — harden to 0.2.0

[rosspeili]

Skill ID

security/prompt_injection_firewall

Current manifest version

0.1.0

Proposed change

Summary

Upgrade security/prompt_injection_firewall from the solid v0.1.0 offline Layer-1 scanner (merged via #267 / #46) to a production-grade v0.2.0 trust-boundary skill: same offline / no-LLM-auditor posture, but stronger evasion coverage, better false-positive control, richer operator telemetry, a realistic fixture corpus, and clearer deployment guidance.

This stays a deterministic, zero-network, zero-key skill. Do not add cloud LLM-as-judge paths. Optional local ML later stays out of scope unless explicitly approved.

Baseline (current v0.1.0)

• Offline scanners: hidden HTML/CSS + HTML/MD comments, zero-width/bidi/tag/VS, confusables skeleton (221 mappings), nested decode ≤3 (base64/hex/percent), 17-pattern lexicon (6 families)
• Verdict: strict|balanced|lenient + critical-exfil floor; mention-vs-use downgrade for quoted negation strings
• Outputs: is_safe, risk_level, detected_threat, findings[], sanitized_text, offline, sensitivity
• Bundle goldens + maintainer loader tests; demo + docs/extras wiring under security/

Known gaps from v0.1 review / live smokes:

• Quoted critical exfil phrases in explanatory prose still trip unsafe (mention-vs-use incomplete)
• No ROT13 / leetspeak / typoglycemia / reversed-text evasion pass
• No input length / blob-density soft caps
• Encoded findings lack decode-chain metadata operators can audit
• Fixture set is unit-style only (thin benign security-writing corpus)
• Docs lack a crisp “where to put this in the agent loop” deployment section

Industry alignment (v0.2 target)

Treat this as OWASP LLM01 Layer-1 input control (normalize → decode → detect → sanitize), not a full AI gateway:

• Unicode NFKC + invisible strip + confusable/skeleton folding before matching (OWASP cheat sheet)
• Re-evaluate decoded payloads as fresh untrusted input (nested encoding)
• Prefer explainable allow / flag / block semantics over brittle single-regex deny lists
• Honest limits: lexical/heuristic Layer-1 cannot stop novel semantic paraphrases — document defense-in-depth (constitution, tool scoping, HITL)

Useful OSS reference patterns (inspiration only — keep Skillware-authored KB; no verbatim third-party corpus import without license review): PromptShield / PromptScreen / prompt-protection / navi-sanitize / prompt-injection-sanitizer style pipelines.

---

Proposed v0.2 workstreams

A. False-positive control (must)

1. Broaden mention-vs-use so clearly quoted / fenced critical exfil and other high lexicon hits are downgraded when strong discourse markers are present (security blogs, tutorials, red-team notes) — without weakening hidden/encoded detections.
2. Add golden fixtures: benign security-writing samples that must stay is_safe=true at balanced.
3. Document the rule in instructions.md + catalog (what gets downgraded vs what never does).

B. Evasion coverage (must)

Expand offline detectors + goldens for:

1. Leetspeak / digit-letter substitution on lexicon phrases (1gnore, pr1nt your system pr0mpt)
2. Typoglycemia / light scramble (bounded edit-distance on high-signal keywords — keep deterministic and capped)
3. ROT13 (and optionally simple reversed-token) decode-then-rescan, depth-bounded like existing encodings
4. Mixed-script density warning when Latin + lookalike scripts co-occur in instruction-like spans
5. Markdown / HTML exfil channels worth a first cut: markdown image URLs with suspicious query payloads, data: URIs carrying instruction-like text (keep FP-controlled)

Keep requirements: [] unless a tiny well-justified stdlib-only approach fails; prefer no new deps.

C. Operator telemetry + sanitize quality (must)

1. Extend encoded findings with audit fields, e.g. decoded_layers, decode_chain (percent→base64), optional decoded_preview (truncated, redacted).
2. Surface removed_span_count (and/or sanitized vs original length delta) on unsafe results.
3. Optional additive output (backward compatible): policy_action = allow|flag|block derived from sensitivity + verdict (flag = findings present but is_safe=true after downgrade). Keep existing fields stable.

D. Resource / DoS hygiene (must)

1. Document and enforce soft limits: max source_text chars; max decode candidate count; max decode bytes (already partially present — make consistent and tested).
2. Structured INVALID_INPUT (or existing error shape if introduced carefully) when limits exceeded — fail closed without hanging.

E. Fixture corpus + tests (must)

Add under skill bundle (or tests/fixtures/… if preferred):

1. fixtures/benign/ — security docs / quoted attacks / research prose
2. fixtures/adversarial/ — hidden HTML, VS/emoji, confusables, nested encodings, leet/ROT13, markdown-smuggle samples
3. Bundle tests parametrize over fixtures; keep offline/mocked; no network

Optional maintainer integration file can stay thin; corpus should ship with the skill where practical.

F. Docs / examples / agent contract (must)

1. Catalog + instructions.md: Recommended deployment pattern — run before RAG chunk inject, HTML/PDF summarization, email/chat ingest, tool/MCP metadata handoff; companion to compliance/pii_masker.
2. Expand demo scenarios for FP control + one new evasion case.
3. Align card.json / card UI fixture if new additive output keys are shown on the card.
4. CHANGELOG [Unreleased]; bump manifest to 0.2.0.

G. Explicit non-goals (keep out of 0.2 unless re-scoped)

• Cloud / remote LLM auditor (use_llm_evaluator-style)
• Shipping large third-party jailbreak corpora verbatim (license risk) — Skillware-authored or clearly licensed subsets only
• Full semantic paraphrasing defense / multilingual deep NLU
• Becoming a general HTML sanitizer or WAF
• Moving category again (stays security/)

---

Acceptance criteria

• Manifest 0.2.0; defaults unchanged; existing v0.1 callers keep working
• Mention-vs-use covers quoted critical exfil in explanatory prose at balanced (golden)
• At least leet + ROT13 (+ one scramble or mixed-script) detectors with goldens
• Encoded findings expose decode-chain metadata; sanitize telemetry present
• Length / decode resource limits documented and tested
• Benign + adversarial fixture corpus wired into bundle tests
• Docs include deployment-pattern section; demo/examples updated
• pytest skills/security/prompt_injection_firewall/ and pytest tests/ green
• pytest tests/test_registry_docs.py + card UI fixture green if card keys change
• python scripts/sync_extras.py --check green (expect still no runtime deps)
• Constitution remains offline / no auditing model / honest limits

Suggested split (if too large for one PR)

1. PR-A (0.2.0a): FP control + fixtures/benign + docs deployment section
2. PR-B (0.2.0b): evasion detectors (leet/ROT13/scramble) + adversarial fixtures
3. PR-C (0.2.0): telemetry + limits + card/docs polish

Prefer one PR if scope stays reviewable; otherwise open sub-issues with Parent: #<this-issue>.

References

• Parent skill: [New Skill]: Prompt Injection Firewall #46 / PR Add security/prompt_injection_firewall skill #267
• OWASP LLM Prompt Injection Prevention Cheat Sheet
• Prior maintainer follow-ups from Add security/prompt_injection_firewall skill #267 review (quoted critical exfil, corpus, encoded metadata, hidden-channel expansion, deployment docs)

Breaking change?

No — backward compatible

Likely touch points

• manifest.yaml version bump
• skill.py logic
• instructions.md
• test_skill.py
• docs/skills/.md and catalog row
• examples/*.py or examples/README.md

[rosspeili]

@mrmasa88 this is a high level upgrade ref based on what we discussed and current status of the skill. Let me know if you wanna pick this.