AI-Assisted Secure Coding (Appendix C) · Secure Prompt & Context Management
Screen repository content for injection
Verify that any externally sourced context being fed to an AI tool is treated as untrusted and screened for prompt injection before it reaches the prompt. Sources to cover: PR descriptions and comments, fork-supplied diffs, issue bodies, commit messages, third-party documentation, web search results, and MCP tool outputs.
OWASP AISVS v1.01, requirement AC.3.3
In plain English
Treat anything from outside your team that is fed to an AI tool as untrusted, and screen it for prompt injection first. That includes PR descriptions and comments, fork diffs, issues, commit messages, third-party docs, search results and MCP tool output.
What good looks like
- Each external source is screened before it reaches the prompt.
- Flagged content is blocked or clearly marked.
- The tool's configuration documents which sources it reads.
How teams usually do it
- The injection detection from 2.1.3, applied in the bot or assistant integration.
Evidence an auditor would accept
- Configuration and test results with poisoned PR content.
Common mistakes
- Screening issue text but not commit messages or file contents.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.