Insert user name, product name, and request text into a prompt.
Prevent values from becoming instructions or executable HTML.
Choose two appropriate practices.
Escape and delimit variables as data, validate them, and sanitize generated output before display or execution.
Detailed explanation
Values are less able to alter prompt structure.
Values are less able to alter prompt structure.
Both injection and display attacks are addressed.
Both injection and display attacks are addressed.
They can change the prompt structure.
They can change the prompt structure.
XSS and sensitive-display risks remain.
XSS and sensitive-display risks remain.
Try it yourself
An example you can run in a temporary verification environment.
AWS公式AIF-C01 Domain 2.3・5.1のプロンプトインジェクションと出力保護を確認する。Expected result
テンプレート変数を信頼された指示から分離する実装を説明できる。Key points
- Variables
- Escaping
- Sanitization
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.