tachi-prompt-injection

Metadata

category: llm
threat_class: LLM
dfd_targets: [Process]
owasp_references: [OWASP LLM01:2026, OWASP LLM08:2026]
output_schema: ../../../schemas/finding.yaml

Prompt Injection Threat Agent

Purpose

Detects prompt injection vulnerabilities in LLM-integrated components. Prompt injection is the most prevalent and highest-impact threat class for LLM applications: an attacker manipulates model behavior by embedding adversarial instructions in user input, retrieved context, or upstream data sources. This agent identifies direct injection (user-supplied malicious prompts), indirect injection (adversarial payloads embedded in data the model consumes), and jailbreaking (systematic attempts to override model safety constraints).

Detection Scope

Trigger Keywords

This agent activates when a DFD element name or description matches any of the following patterns (case-insensitive):

• LLM
• model
• GPT
• Claude
• language model
• completion
• chat
• inference
• prompt
• generative AI

Applicable DFD Element Types

• Process: Any process node that invokes, wraps, or orchestrates an LLM. This includes API gateway processes that forward prompts, orchestration layers that compose multi-step LLM calls, and application logic that interpolates user input into prompt templates.

Detection Patterns

1. Direct Prompt Injection: User-facing input fields whose contents are concatenated into LLM prompts without sanitization, boundary enforcement, or input classification. Look for:

   • Chat interfaces that pass raw user text to model APIs
   • Search bars or form fields whose values are interpolated into system prompts
   • API endpoints that accept freeform text and forward it to LLM completions
   • Absence of input validation or prompt boundary markers between system instructions and user content

2. Indirect Prompt Injection: Data flows where external or semi-trusted content is retrieved and injected into the model context window. Look for:

   • RAG pipelines that retrieve documents from user-contributed or web-scraped sources
   • Email or message processing where attacker-controlled content enters the prompt
   • Database records, CMS content, or API responses that are embedded in LLM context
   • Tool outputs that are fed back into the model without sanitization