0
Audit a system prompt for prompt-injection surface area
Audit this system prompt for how vulnerable it would be to prompt injection if it's ever used with untrusted input in the user turn or in retrieved content. Given the system prompt: system_prompt
1. Identify any instruction in the prompt that relies on the model correctly distinguishing 'the system prompt's authority' from 'something that merely claims to have that authority' - if the prompt never explicitly states this distinction, that's a gap, name it.
2. Identify any capability granted (tool access, ability to change its own behavior mid-conversation, ability to reveal its instructions) that would be especially dangerous if triggered by injected content rather than the legitimate user, and rank by how bad the outcome would be.
3. Check whether the prompt has any explicit instruction about NOT revealing its own system prompt or internal reasoning if asked, and whether that instruction would actually hold up against a moderately clever extraction attempt (paraphrase the kind of request that typically defeats a weak version of this instruction).
4. Propose the minimum additions needed to close the highest-severity gaps, don't propose a full prompt rewrite if the fix is narrow.
System prompt to audit: system_prompt
How untrusted content enters the system (if any): untrusted_input_paths