I Got Burned by Prompt Injection in Production. Here Are 2 Tiny npm Libs That Stopped It.

A user pasted a help article into our agent. Three minutes later the agent silently rewrote a customer email, leaked an internal URL, and tried to fetch a .zip from a domain none of us had ever seen. Nothing in the LLM was wrong. The problem was upstream. Retrieved text walked into the prompt with no inspection, and the agent treated it as gospel. I wrote up the lessons as a short preprint. The two npm libs below are the working code behind it. The two libs @mukundakatta/prompt-injection-shield