Add compliance/prompt_injection_firewall skill

[mrmasa88]

Summary

• Adds compliance/prompt_injection_firewall, an offline deterministic pre-flight scanner for hostile instructions in untrusted text.
• Detects hidden HTML payloads, invisible Unicode smuggling, instruction overrides, jailbreak framing, boundary spoofing, encoding smuggling, and common exfiltration patterns.
• Returns {is_safe, detected_threat, sanitized_text, action, confidence, threats} with optional Gemini second opinion (disabled by default).
• Ships full skill bundle, catalog docs, card UI schema fixture, and adversarial tests.

Fixes #46

Test plan

• pytest skills/compliance/prompt_injection_firewall/test_skill.py
• pytest tests/test_skill_issuer.py
• pytest tests/test_registry_docs.py
• pytest tests/test_card_ui_schema.py
• pytest skills/ tests/ (332 passed)

Made with Cursor

[rosspeili]

Thanks @mrmasa88, this was a good start as expected when following the AI native workflow from earlier today. Some things to address before merge:

The heuristic core is solid and useful as a Layer-1 trust-boundary scanner, but I would remove the Gemini use_llm_evaluator path from v0.1**, sending untrusted text to a cloud LLM breaks the offline/private posture we refreshed on #46. Happy path = zero network, zero keys. Add offline: true (or equivalent) on responses.

Coverage is a good base but not complete yet. Still add detectors + golden tests for: homoglyphs/confusables, variation-selector / emoji smuggling, markdown/HTML comments actually wired, and at least one nested encoding case. Include one false-positive fixture so the lexicon isn’t hair-trigger. Overal, think about it, and discuss with your model to see what kind of protection a prompt injection firewall could have locally, then pass your insights to the worker model.

On category, I have a feeling this could be under security later, but compliance is good for now as requested from the issue, need to think about it.

Some minor things

• Add examples/prompt_injection_firewall_demo.py (local execute) + row in examples/README.md
• Point docs/usage/agent_loops.md at that example (not catalog-only)
• Update docs/usage/install_extras.md (skill row + compliance list)
• Complete manifest outputs / parameter defaults, prefer from .firewall import … over sys.path hacks
• Keep green: black / flake8, bundle tests, test_registry_docs, test_card_ui_schema, python scripts/sync_extras.py --check, these are already green and correctly formatted, make sure they are run again before your next commit just to be sure after any changes.

on PR process

Since this was automatically opened by the agent, it's ok, but as with the previous PR notice, please try to manually open PRs from your fork, and not let the agent to do it. Agents can commit and push to your fork, from where it is recommended you manually open PR, review the code one last time before PR, and use PR template in content block, short is fine, eg. skip empty N/A noise, also don’t include “Made with Cursor.”

Ping when updated and I’ll re-review and merge if green. This is good as a v0.1. In short, I would take some time to think, or discuss with AI, what kind of practices and methods we should use to run this locally without relyig on external models to review prompts, considering if prompt injection is found, it can harm also the auditing model. There was a good repo karpathy shared with context about prompt injection patterns and types that could be used as local reference set, similar to wallet screening or mica skills. Just an idea, don't take it by word, maybe you find a better format. <3