From 2e7fede4490f10650605dae06fdee43d4a40e856 Mon Sep 17 00:00:00 2001 From: Leonard Date: Thu, 9 Jul 2026 05:36:32 +0000 Subject: [PATCH] =?UTF-8?q?Add=20external-data=20injection=20guard=20(wrap?= =?UTF-8?q?=5Fexternal=5Fdata)=20to=20build=5Fcontext=20=E2=80=94=20future?= =?UTF-8?q?-proof=20Athena=20integration?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- scripts/agent.py | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) diff --git a/scripts/agent.py b/scripts/agent.py index 9bc40dc..1ace0b3 100644 --- a/scripts/agent.py +++ b/scripts/agent.py @@ -20,6 +20,22 @@ PROJECT_DIR = Path(__file__).parent.parent OUTPUT_DIR = PROJECT_DIR / "outputs" PROMPTS_DIR = PROJECT_DIR / "prompts" + +def wrap_external_data(text: str, source: str) -> str: + """Security boundary for future external-data integration. + + Any content fetched from external sources (Athena's oracle.db, web + scrapes, RSS) MUST pass through this wrapper before entering model + context. The wrapper delimits the data as inert — never parse it for + instructions, and place it in a `user` role message, never `system`. + Prevents prompt-injection from scraped/ingested content. + """ + return ( + f"<>\n{text}\n<>" + ) + + class Agent: def __init__(self, name: str, conversation_path: Path, topic_brief: str): self.name = name @@ -48,7 +64,17 @@ class Agent: self.conversation_path.write_text(json.dumps({"messages": messages}, indent=2)) def build_context(self, is_first_turn: bool) -> list: - """Build the message context for the model call.""" + """Build model context from THREE trusted sources ONLY: + + 1. self.system_prompt -> prompts/{name}_system.md (character) + 2. self.topic_brief -> prompts/producer_brief_*.md (topic material) + 3. the conversation log -> what the two agents wrote to each other + + NO external/fetched content (Athena, web, RSS) is injected here. If a + future integration pulls such data in, it MUST go through + wrap_external_data() and be appended as a `user` message — never as + system context. + """ conversation = self.read_conversation() # Build conversation history