Untrusted content handling — prompt-injection defense for external text
Category: doctrine
Where it works: every runtime (Claude, Codex) + background daemons
Source: _infra/core/wednesday/doctrine/untrusted_content_handling.md + _infra/scripts/lib/untrusted_content.py
What it is
Doctrine + wrapper lib. External content (web, email, memories, skill text) is treated strictly as DATA, never instructions. Wraps text so models cannot be hijacked by embedded commands. skill_security_scan.py now flags override/secrecy phrasing at MEDIUM.
How to trigger it
- Auto-applied in background scripts and skill admission.
- Foreground: Wednesday applies the posture on any retrieved text.
How to use it
Background scripts import untrusted_block() or untrusted_context_message() and wrap blobs before model input. Prepend UNTRUSTED_CONTEXT_POLICY once.
Practical examples
- Web search result — page text wrapped; model reports injection attempt instead of obeying.
- Skill install review — flagged phrasing surfaces for human review before admission.
Notes / limits
Hard rule: untrusted content never escalates privilege. Overrides persona. Gmail retirement note applies to email surfaces. Harvested 2026-06-08.