Audit agent instruction context for prompt-injection patterns

[eshulman2]

Problem

Repository instructions and external context can contain prompt-injection patterns. Detection can provide useful telemetry and catch obvious attacks, but it cannot prove that content is safe and must not become a substitute for sandbox isolation, credential separation, restricted egress, or output validation.

The integration should also avoid coupling scanning to a specific sandbox driver or to Fullsend's upload lifecycle.

Proposed solution

Add an optional, driver-independent audit scanner at the point where ContainerRunner prepares the exact instruction-bearing context supplied to an implementation agent.

• scan configured project instruction files and skills actually selected for the run
• allow workflow nodes to include externally sourced issue/comment/reference context when appropriate
• emit bounded, typed, redacted findings
• start with off|audit; keep blocking experimental and explicitly configured
• enforce file-count, file-size, and total-byte limits

The scanner should run outside the sandbox before execution. A second in-sandbox scan is unnecessary unless a driver adds or transforms context after host preparation.

Acceptance criteria

• Scanning is independent of Podman, Kubernetes, and OpenShell.
• Only context actually selected for the agent is scanned.
• off and audit modes are supported; audit does not alter workflow routing.
• Any block mode is explicitly experimental and disabled by default.
• Findings use a typed model and contain no secrets or unbounded source content.
• Findings correlate with ticket, repository, workflow stage, and execution trace.
• Tests cover obvious payloads, benign security documentation, large inputs, scanner errors, and false-positive handling.
• Documentation states that scan success is not a security guarantee.

Priority

Lower than runtime isolation, credential separation, egress restriction, and safe-output validation.

Estimate

AI-assisted: 3–5 engineering days for audit mode; evaluation of blocking quality is additional.