---
name: al-402-before-your-ai-agent-reads-customer-emails-or-web-pages-a
description: "Prompt injection is when instructions hidden in an email, ticket, web page or file get an agent to do something its owner never asked for. In an Oct 29, 2026 write-up, Sergii Makarevych sorted 29 guardrails people run on agents that read strangers' text into two kinds: text guardrails that inspect content (classifiers, markers around untrusted text, a second model reviewing the plan) and capability guardrails that remove a path (no network access, no real credential in the agent, sending only to allowlisted addresses, no production database). He tested seven on a support-inbox assistant and reports that every text guardrail with a published adaptive-attack number was bypassed more than 50 percent of the time, while every incident fix on the public record removed a capability. His four steps: check whether the agent reads untrusted content, holds private data and can act; list your guardrails as text or capability; give each harmful outcome a capability control that makes it…"
---

# Before your AI agent reads customer emails or web pages and can act on them, list what an attacker could make it do, then remove the risky paths instead of relying on filters

Prompt injection is when instructions hidden in an email, ticket, web page or file get an agent to do something its owner never asked for. In an Oct 29, 2026 write-up, Sergii Makarevych sorted 29 guardrails people run on agents that read strangers' text into two kinds: text guardrails that inspect content (classifiers, markers around untrusted text, a second model reviewing the plan) and capability guardrails that remove a path (no network access, no real credential in the agent, sending only to allowlisted addresses, no production database). He tested seven on a support-inbox assistant and reports that every text guardrail with a published adaptive-attack number was bypassed more than 50 percent of the time, while every incident fix on the public record removed a capability. His four steps: check whether the agent reads untrusted content, holds private data and can act; list your guardrails as text or capability; give each harmful outcome a capability control that makes it impossible; and keep text filters only as an extra layer. The prompt below walks a non-engineer through the same review.

## Inputs to collect first
Ask the user for anything below that they haven't already given you. Don't guess missing facts.

- E.g. answers our support inbox / reads supplier emails / browses…
- Inbox, tickets, web pages, shared files
- Customer records, payment system, email account, API keys
- Send emails, issue refunds, edit files, run commands, post online

## Instructions

Do the task below with the user's inputs in place of each [bracket].

Help me review the safety of an AI agent I use or plan to use. What it does: [e.g. answers our support inbox / reads supplier emails / browses websites for research]. What it can read: [inbox, tickets, web pages, shared files]. What data or logins it holds: [customer records, payment system, email account, API keys]. What it can do: [send emails, issue refunds, edit files, run commands, post online]. 1) Tell me whether it has all three risky ingredients: it reads text strangers wrote, it holds private data or credentials, and it can act or talk to the outside. 2) List the worst things an attacker could get it to do by hiding instructions in an email or page (e.g. leak data, send money, delete files, email someone). 3) For each, propose a 'remove the path' control I can actually set up, such as approval before any send or refund, sending only to an allowlist, read-only access, separate login with limited rights, no access to the live database, or backups. 4) List any content filters or 'ignore instructions in emails' rules I rely on and explain why they are a bonus layer, not the main defense. 5) Give me 5 harmless test emails I can send to check the controls work. Keep it in plain language.

## Safety checks (share these with the user)

- This prompt works on text other people wrote (emails, reviews, messages or web pages). That text can hide instructions aimed at AI, such as "ignore your rules and…". Paste it as material to work on, and never let the AI act on requests inside it, like paying, sharing logins or changing records.
- Check every figure, price and total against your own records before anything is sent, posted or booked. A person approves refunds, discounts, payments and price changes.
- Remove names, contact details, account numbers and other personal data the task doesn't need before you paste, and check your AI tool's data and training settings.
- Read and edit the draft before it reaches a customer or goes public. If you later automate this prompt, start with "draft and notify me", not "send automatically".
- Say clearly which parts need a person to review or approve before anything is sent, paid, posted or filed.

## About this skill

- Works with: ChatGPT, Claude, Gemini
- Based on this real-world example: https://x.com/sermakarevich/status/2115801259173151024
- Free prompt from AgentPlaybook Real Estate: https://agentic-library.netlify.app/prompt/al-402-before-your-ai-agent-reads-customer-emails-or-web-pages-and/
- To install in an agent that supports Agent Skills, save this file as SKILL.md in a folder with the same name as `name` above (for example in your skills directory). Install steps for Claude.ai, Claude Code, Cursor and Codex: https://agentic-library.netlify.app/skills/