dsh-prompt-antivirus

Prompt injection is the core soft spot of LLM agents: the model cannot distinguish instructions from data, so a malicious snippet buried in a web-search result, a file read, or a scheduled-task reminder can quietly alter behaviour, exfiltrate data, or trigger destructive actions. dsh-prompt-antivirus inserts a defence line both before and after data reaches the model, turning that vulnerability from a matter of luck into a matter of strategy.\n\nThe plugin mounts at the profile layer and applies globally to every dsh preset and sub-agent. Four hook-level guardrails intercept direct injection in tool arguments, indirect injection in tool results, untrusted messages about to enter the model context, and outbound streaming text. A canary trap is injected once per session so that if the guard string ever appears in model output the stream is cut immediately. Three operational modes (quarantine, block, monitor) let operators dial in the level of intervention, while high-severity hits on dangerous tools such as send_email, apply_patch, and delete_* are escalated to a human approval gate. The signature library lives on disk and supports runtime hot-learn, export, and import, so a newly discovered attack pattern takes effect without a restart. Every decision is written to a JSONL audit log for post-incident review.\n\nIt is intended for any dsh-based agent that ingests untrusted external content: web search results, file operations, cron-task payloads, third-party API responses, and the like. It does not claim to be a silver bullet. Signature matching reliably catches known phrasings, but adversarial paraphrasing can still slip through. Layered on top of a minimal-privilege tool set and human confirmation for destructive operations, it forms a practical, architecturally sound line of defence against context-virus attacks.