Objective & prerequisites
Keep source documents and model suggestions outside application authority. Prerequisites: basic Python expressions and files; use a disposable local practice folder and fictional data. This shared workshop complements the existing data/AI tracks and does not create a second progress system.
Understand the concept
Prompt injection places instructions inside material the application should treat as data. A warning prompt alone cannot enforce permissions. Keep tools allowlisted, validate arguments and require authorization independently of any model’s output. Never evaluate generated code or let a document choose an arbitrary filesystem path.
Worked example
dispatch_tool permits only sum_cents with a closed rows envelope. A fictional request to read_file is refused even if a model or document asks for it. structured_answer rejects citations outside the known source set. The reference has no model, shell tool, file-reading tool or external provider.
from foundation_labs import dispatch_tool
result=dispatch_tool("sum_cents",{"rows":[{"id":"A","amount_cents":70000}]})
assert result=={"total_cents":70000}Try it yourself
Run the AI contract test and write an unauthorized tool suggestion as a local string. Explain why changing wording or confidence should not expand the allowlist. Record your prediction before running the supplied reference, then compare the observed result and explain any difference.
Worked solution
Unknown tools and extra arguments fail before dispatch. Known tool arguments still pass the numeric/key contract. These controls are limited demonstrations, not a proof that every future AI application resists prompt injection.
Knowledge check
Can a retrieved document grant the assistant permission to read private files? Try answering without rereading the example.
Check and explain
No. Source text is evidence to interpret, not trusted application authority.
Mini-project, mistakes & handover
Produce a short README with the question, exact local command, input meaning, checks and actual results. Include one failure case and its explanation. Never silently turn an exception into a passing result. Mark simulated behavior explicitly, credit the supplied teaching code and identify your own contribution. These activities are unsaved self-practice, not certification.
Authoritative reference
01-prompt-injection/ — consulted for the underlying interface/concept. The lesson and fictional examples are original teaching material. Python reference tested with 3.12; designed for 3.10+. Git lab requires Git 2.28+.
Try the activity before reading its reference. Keep your sources, commands and assumptions with your work. Companion activities are unsaved self-practice and do not award a certificate or change lesson progress.