Introduction

Prompt injection is a core weakness of LLM agents: models struggle to distinguish between “instructions” and “data”. Malicious instructions hidden in text such as web search results, file contents, [CRON TASK] / [SCHEDULE REMINDER] can covertly alter behavior, exfiltrate data, or execute destructive operations—what is known as “contextual virus infection”.

dsh-prompt-antivirus is a global plugin for preventing prompt injection / contextual virus infection. It adds a line of defense both before and after data enters the model, covering all dsh presets and sub-agents. The plugin is maintained by QinpanWan, follows the MIT license, is implemented in pure JS, and has no native dependencies.

Core Features

The plugin mounts interception logic at four key points:

  1. Tool argument scanning (tools/pre-execute)

    • Scans malicious instructions in tool call arguments.
    • High-risk hits are directly denyed.
    • High-risk hits combined with dangerous tools (such as send_email / apply_patch / delete_*) trigger ask (manual approval).

  2. Tool result scanning (tools/post-execute)

    • Scans malicious content in tool results.
    • block mode converts the result into an error state.
    • quarantine mode replaces matched fragments.

  3. Pre-model message scanning (agent/pre-step)

    • Scans prompts about to be sent to the model.
    • High-risk messages are quarantined or replaced before ingestion.
    • A “canary guard” message is injected once per session.

  4. Outbound text sanitization (llm/stream)

    • Scans replies generated by the model.
    • Interrupts output when a canary guard is detected (block mode).
    • Replaces malicious fragments in outbound text.

Defense Modes

The plugin provides three operating modes, defaulting to quarantine:

  • quarantine (Quarantine mode)
    • Behavior: Paths that can be modified in place (tool results, messages, outbound text) replace matched fragments; tool arguments cannot be modified in place, so they are directly rejected with an explanation.
  • block (Block mode)
    • Behavior: Same as quarantine mode, plus “interrupt output immediately on canary hit” and stricter rejection policies.
  • monitor (Monitor mode)
    • Behavior: Only records audit logs, without interfering with execution.

Evolvable Signature Library

The signature library is not hardcoded in the code; it is stored on disk and supports hot updates.

  • Storage path: Default rules/virus-signatures. (can be overridden via the environment variable PROMPT_ANTIVIRUS_RULES_PATH).
  • Automatic initialization: The default library is written to disk automatically on first startup.
  • Maintenance commands:
    • _antivirus_learn <sample> [category]: Extracts signatures from missed attack samples and persists them.
    • _antivirus_rules_export: Exports the current virus library as a JSON string for sharing.
    • _antivirus_rules_import <rules>: Merges an external virus library (deduplicated by regex source).
    • _antivirus_status: Displays the current configuration and the most recent 20 audit entries.

Installation and Activation

Use the official command to install the plugin, then restart dsh web to apply the configuration.

dsh plugin --profile web add github:QinpanWan/dsh-prompt-antivirus

After installation, restart dsh web. The startup logs should contain [prompt-antivirus] loaded. The plugin is mounted at the profile layer and takes effect globally for all presets and sub-agents.

Typical Usage

  • Scan text:
    _antivirus_scan "some input"
  • Learn attack samples:
    _antivirus_learn "malicious sample" "attack_type"
  • Check status:
    _antivirus_status
  • Export/import virus library:
    _antivirus_rules_export
    _antivirus_rules_import <rules>

Notes and Limitations

  • Limitations: Signature scanning is essentially a “whack-a-mole” approach—it can reliably match known phrasing, but paraphrased attacks may slip through. Pair it with least-privilege tool sets and manual confirmation for dangerous operations (high-risk hits combined with dangerous tools default to the approval channel).
  • Audit logs: Written to disk by default at ~/.dsh/task-board/prompt-antivirus-audit.l.
  • Dependencies: Depends on @deepseek-ai/dsh-tools and @deepseek-ai/dsh-llm (peerDependencies).

References