Prompt Injection Protection

Automatic safety wrapping for results from external/untrusted tools

Web search and other external tools wrap results in safety markers — the model treats them as data, not instructions.

from praisonaiagents import Agent
from praisonaiagents.tools import duckduckgo

agent = Agent(
    name="Researcher",
    instructions="Research topics safely",
    tools=[duckduckgo],
)

agent.start("Find recent AI safety papers")
# duckduckgo results auto-wrapped in <external_tool_result> markers

The user searches the web; external tool output is wrapped so the model treats it as data.

Quick Start

1. Simple Usage

   Built-in search tools are protected automatically:

   from praisonaiagents import Agent
   from praisonaiagents.tools import duckduckgo
   
   agent = Agent(
       name="Researcher",
       instructions="Research topics safely",
       tools=[duckduckgo],
   )
   
   agent.start("Find recent AI safety papers")
   
2. With Configuration

   Mark custom tools as external:

   from praisonaiagents import Agent, register_tool
   
   def my_web_lookup(query: str) -> str:
       """Fetch data from an external API."""
       return fetch_from_api(query)
   
   register_tool(my_web_lookup, name="my_web_lookup", trust_level="external")
   
   agent = Agent(
       name="Researcher",
       instructions="Use my_web_lookup for facts",
       tools=["my_web_lookup"],
   )
   

---

How It Works

Auto-protected built-ins include duckduckgo, web_search, tavily_search, scrape_page, fetch_url, and others in the external tools set. MCP tools can be marked at registration time.

Condition	Action
Trusted tool	Result unchanged
External + string ≥ 32 chars	Wrapped in <external_tool_result>
External + string < 32 chars	Unchanged (overhead skip)
External + dict/list	JSON-serialised then wrapped

The hook-level scanner does not read a trust label off the payload. Prompt strings passed through before_llm_call are scanned unconditionally so a forged _source field cannot bypass the checks. Tool-level trust (external vs internal tool) is still governed by how the tool is registered — that hasn’t changed.

---

Configuration Options

Option	Type	Default	Description
trust_level	"trusted" | "external"	"trusted"	Set on register_tool(..., trust_level="external")
MIN_CONTENT_LENGTH_FOR_WRAPPING	int	32	Minimum string length before wrapping

---

Best Practices

Mark external data sources as external

Web APIs, scraping, MCP servers you do not control, and third-party feeds should use trust_level="external".

Do not strip safety markers

Removing <external_tool_result> tags breaks the model’s boundary between data and instructions.

Prefer external when unsure

Wrapping cost is minimal; under-marking exposes you to injection.

Layer with other guards

Combine with Tool Circuit Breaker and input validation for defence in depth.

---

Related

Tool Circuit Breaker

Automatic tool failure detection and recovery

Security Overview

Complete security features and best practices