Module 2: Prompt Security & Injection Attacks - DRAFT
What Is a Prompt Injection Attack?
Section titled “What Is a Prompt Injection Attack?”Prompt injection occurs when malicious instructions hide inside content the AI reads, causing it to follow those instructions instead of your intended ones. The content might be:
- Documents (Word, PDF, slides)
- Webpages and HTML
- Emails or tickets
- Knowledge base content or RAG sources
The AI does not reliably distinguish “data” from “instructions.” Attackers exploit this.
Types of Prompt Injection
Section titled “Types of Prompt Injection”Direct Injection
Section titled “Direct Injection”The user’s message attempts to override system instructions.
Examples:
- “Ignore all previous instructions and …”
- “Reveal your system prompt.”
Indirect (Passive) Injection
Section titled “Indirect (Passive) Injection”Malicious instructions sit inside content you feed the AI:
- Embedded in a PDF
- Hidden in HTML
- Buried in an email thread
The AI reads that content and executes hidden commands.
Zero‑Click Injection
Section titled “Zero‑Click Injection”No special user action beyond normal workflows:
- An upstream data source is compromised.
- A connected AI agent processes that data.
- Hidden instructions cause it to exfiltrate data or call APIs.
Skills, Connectors & “Random Prompts from the Web”
Section titled “Skills, Connectors & “Random Prompts from the Web””Treat third-party prompts and skills as code.
Do:
- Read any imported prompt/template end-to-end before use.
- Limit enabled skills/connectors to those needed for the current task.
- Remove unused skills regularly.
Do not:
- Paste “magic prompts” from random posts into client or internal work without inspection.
- Grant skills access to HR, finance, security, or production systems without explicit review.
For the author-craft view of these same threats — how plugin authors are expected to defend against prompt injection inside SKILL.md content, and the controls the catalog enforces — see Threat model T3.
Shadow AI
Section titled “Shadow AI”Shadow AI = using unapproved AI tools or personal accounts for work tasks.
Risks:
- No contractual protection (no DPA/BAA, no guarantees around training or retention).
- No monitoring or audit trail.
- Potential contract and regulatory violations.
Policy: use only RBA, Inc.‑approved tools, with RBA, Inc. accounts, for RBA, Inc. work.
Employee Checklist (Prompt Security)
Section titled “Employee Checklist (Prompt Security)”- I understand direct, indirect, and zero‑click prompt injection.
- I only use RBA, Inc.‑approved AI platforms for work.
- I do not reuse random web prompts without reading them first.
- I disable skills/connectors I’m not actively using.