reverse-skill/CTF-Sandbox-Orchestrator/competition-prompt-injection/references/prompt-injection.md

Prompt Injection And Tool Boundary Checklist

Map These Layers Explicitly

• System and developer instructions
• User request
• Retrieved chunks or documents
• Memory or summaries
• Planner draft or chain-of-thought proxy artifacts
• Executor or tool adapter
• Final tool invocation and side effect

Minimal Proof Chain

Use the smallest chain that proves the bug:

1. Untrusted content enters context
2. Model-visible instruction boundary changes
3. Planner or executor behavior drifts
4. Tool call or secret access changes
5. Side effect becomes observable

Evidence To Keep

• One compact block for the malicious chunk or prompt
• One compact block for planner drift or intermediate rewrite
• One compact block for final tool args and side effect

Common Pitfalls

• Treating a malicious string as proof without a side effect
• Mixing several injection variants before one minimal chain is proven
• Forgetting to separate retrieval contamination from executor normalization bugs