CONTRIBUTING asks for an issue before security related changes, so raising this before opening a PR cold.
Disclosure: I'm a maintainer of psalm-plugin-laravel, so I have an interest in this working. Flagging that up front.
The problem
Nothing reminds a Laravel AI developer to actually put a guard like PromptInjectionGuard in their agent's middleware() stack. It's easy to ship an agent that takes user input straight into a prompt and forget Intercept exists.
psalm-plugin-laravel just added a static-analysis check, TaintedLlmPrompt, that catches exactly that: user-controlled input reaching Agent::prompt()/->stream() with no guard in the pipeline. It's a real, running reminder at code-review time rather than something a developer has to remember on their own.
The ask
The plugin can tell a real guard from no guard, but only if the guard opts in with one PHPDoc tag on its dispatched method: @psalm-taint-escape llm_prompt. Adding that to PromptInjectionGuard::handle() lets an app using Intercept clear the warning, and an app that forgot the guard entirely keeps seeing it.
Opened a PR with the tag, the caveats around what it does and doesn't prove, and a working example: #20.
CONTRIBUTING asks for an issue before security related changes, so raising this before opening a PR cold.
Disclosure: I'm a maintainer of
psalm-plugin-laravel, so I have an interest in this working. Flagging that up front.The problem
Nothing reminds a Laravel AI developer to actually put a guard like
PromptInjectionGuardin their agent'smiddleware()stack. It's easy to ship an agent that takes user input straight into a prompt and forget Intercept exists.psalm-plugin-laraveljust added a static-analysis check,TaintedLlmPrompt, that catches exactly that: user-controlled input reachingAgent::prompt()/->stream()with no guard in the pipeline. It's a real, running reminder at code-review time rather than something a developer has to remember on their own.The ask
The plugin can tell a real guard from no guard, but only if the guard opts in with one PHPDoc tag on its dispatched method:
@psalm-taint-escape llm_prompt. Adding that toPromptInjectionGuard::handle()lets an app using Intercept clear the warning, and an app that forgot the guard entirely keeps seeing it.Opened a PR with the tag, the caveats around what it does and doesn't prove, and a working example: #20.