HackerNews中文版

我一直在审计开源执行引擎如何处理提示词注入。多数引擎（如 OpenClaw）依赖于三层静态防御：正则表达式黑名单、XML 标签和字符净化。问题在于，正则表达式就像猫捉老鼠的游戏。它在寻找“忽略指令”时，会漏掉“无视之前的指令”。它在多语言攻击面前会彻底失效。一旦 Agent 获得了工具访问权限（shell、数据库），一个语义上的微小偏差就会变成 RCE（远程代码执行）。所以我构建了 Prompt Inspector。它是一个语义检测引擎，旨在超越黑名单。核心优势：基于向量的检测：我们使用嵌入来映射提示词，而不是关键词。即使措辞独特或经过翻译，它也能捕捉到注入的意图。自我演进循环：临界情况会触发异步 LLM 审查。如果是一种新的攻击模式，系统会自动提取嵌入并更新向量数据库。它会从新的攻击中学习。设计上解耦：它返回置信度分数，而不是直接阻止。开发人员可以完全控制执行路由。可插拔：最初使用谷歌最新的嵌入，但该架构允许自定义部署模型，以避免厂商锁定。技术栈：FastAPI、向量数据库、谷歌嵌入模型和一个 LLM 循环审查器。我目前为早期测试者和开源项目提供免费积分。我很想听听大家是如何在基本的提示词工程之外处理工具调用安全性的。网址：https://promptinspector.io

查看原文

I’ve been auditing how open-source execution engines handle prompt injection. Most of them (like OpenClaw) rely on a 3-layer static defense: regex blacklists, XML tagging, and character sanitization.The problem is that regex is a cat-and-mouse game. It misses "disregard prior directives" while looking for "ignore instructions." It fails entirely on multi-language exploits. Once an Agent has tool access (shell, DB), a single missed semantic variation becomes an RCE.So I built Prompt Inspector. It is a semantic detection engine designed to move beyond blacklists.The core deal:Vector-based detection: Instead of keywords, we use embeddings to map prompts. It catches the intent of an injection, even if the phrasing is unique or translated.Self-evolving loop: Borderline cases trigger an async LLM review. If it is a new attack pattern, the system automatically extracts the embedding and updates the vector database. It learns from new exploits.Decoupled by design: It returns a confidence score rather than a hard block. The developer keeps full control over the execution routing.Pluggable: Started with Google’s latest embeddings, but the architecture allows for custom-deployed models to avoid vendor lock-in.Tech-stack: FastAPI, Vector Database, Google Embedding models, and an LLM-in-the-loop reviewer.I’m currently offering free credits for early testers and open-source projects. I’d love to hear how you guys are handling tool-calling security beyond basic prompt engineering.Live at: https://promptinspector.io

我为什么不再用正则表达式来保障 LLM Agent 的安全