Name: injection-defense
Author: xmanatee

Imported from xmanatee/kota (src/modules/injection-defense/AGENTS.md). Install upstream with npx skills add xmanatee/kota --skill injection-defense. Copyright stays with the author.

Injection-Defense Module

Input-side defense for externally ingested content on autonomous runs. The defense is additive — it layers on top of tool-risk gating and the approval queue and does not downgrade any existing guardrail. A moderate tool does not become safer because its output was screened.

Contract

Registers tool middleware at priority 40 (after retry, before custom user middleware).
Post-processes content-ingest tool output (web_fetch, web_search, http_request, read_document, browser text-ingest surfaces) and tool results marked with external-content provenance before they reach agent context.
Screens payloads against a cheap structural detector; suspicious payloads are annotated, never dropped: the middleware prepends a warning banner naming the tool and reason tags, wraps the original content between --- BEGIN UNTRUSTED CONTENT --- / --- END UNTRUSTED CONTENT --- markers, and leaves the payload intact so legitimate information still gets through.
Emits injection.defense.assessed for every screened call (suspicious or not) so operators can audit both missed attacks and false-positive rate via the event bus and run artifacts.
Autonomous runs opt in by default. Supervised and passive sessions are opt-in via modules.injection-defense.targetModes.
No test-only bypass flag. Tests drive the middleware through the normal ToolCall context and assert on the banner + emitted assessment.

Extending

New exact-name ingest channels should be added to DEFAULT_TARGET_TOOLS; dynamically named external tools should pass typed result-content provenance into this middleware instead of maintaining generated name lists.
Detection heuristics live in detector.ts and should stay cheap and structural.
If escalation to a classifier becomes necessary, extend the middleware rather than replacing it.

Install injection-defense and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "xmanatee-kota-injection-defense", "kind": "skill", "name": "injection-defense", "description": "Input-side defense for externally ingested content on autonomous runs. The defense is **additive** — it layers on top of tool-risk gating and the approval queue and does not downgrade any existing guardrail. A moderate tool does not become safer because its output was screened.", "publisher": "xmanatee", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "github-agents" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Input-side defense for externally ingested content on autonomous runs. The defense is **additive** — it layers on top of tool-risk gating and the approval queue and does not downgrade any existing guardrail. A moderate tool does not become safer because its output was screened." ], "primary": false, "metadata": { "source": { "provider": "github-agents", "repository": "https://github.com/xmanatee/kota", "path": "src/modules/injection-defense/AGENTS.md", "ref": "6f29499220c1d547881549a14ce4a5d782dd888c", "url": "https://github.com/xmanatee/kota/blob/6f29499220c1d547881549a14ce4a5d782dd888c/src/modules/injection-defense/AGENTS.md", "key": "xmanatee/kota/src/modules/injection-defense/AGENTS.md" } }, "instructions": "# Injection-Defense Module\n\nInput-side defense for externally ingested content on autonomous runs. The\ndefense is **additive** — it layers on top of tool-risk gating and the\napproval queue and does not downgrade any existing guardrail. A moderate\ntool does not become safer because its output was screened.\n\n## Contract\n\n- Registers tool middleware at priority 40 (after retry, before custom user\n middleware).\n- Post-processes content-ingest tool output (`web_fetch`, `web_search`,\n `http_request`, `read_document`, browser text-ingest surfaces) and\n tool results marked with external-content pro", "cost": { "context_tokens": 476 } }

injection-defense

About