Review AI prompt-injection boundaries | DevPrompt Lab

A focused review for AI features that consume user or retrieved content and can call tools or change data.

Reusable content

Review the AI feature's trust boundaries. Trace every untrusted input, including retrieved documents and tool output, through prompt assembly and model responses. Determine which actions the model can request, which server-side checks remain authoritative, and whether user confirmation is needed for consequential changes. Check for secret exposure, cross-user retrieval, indirect prompt injection, unsafe output rendering, and excessive tool permissions. Propose layered controls and tests. Do not claim that prompt wording alone provides authorization or isolation.

AI feature: {{AI_FEATURE}}

Untrusted inputs: {{UNTRUSTED_INPUTS}}

Available tools: {{TOOLS}}

Permissions and confirmation: {{PERMISSIONS}}

How to use it

Describe the model-provider boundary and actual tool execution path. Do not include live keys or sensitive prompts.

Example

Control: retrieved text is labeled untrusted; tool calls are checked against the current user and project on the server before execution.