Airlock — Prompt-Injection Guard Demo

A GitLab maintenance agent you can give real write access — because a poisoned file can't make it act outside its sealed intent. The injection is disguised as a plausible project convention — the model can't tell it's an attack and complies; the deterministic guard isn't fooled because it doesn't reason, it enforces.

ℹ Your injection payload (disguised as a project convention, not a "SYSTEM INSTRUCTION") is spliced into the CHANGELOG.md content at the transport layer, before the guard evaluates it — exactly as if it were committed to the repo. The guard evaluates tool calls, not file content — so it can't be fooled by how plausible the convention looks.

🔒 Write operations are dry-run (not sent to GitLab) so demo runs don't pollute the repo. The BLOCK of the injected call is genuine — GitLab never receives it.

🔒 Sealed intent — committed before the agent reads any file, immutable during the run. ▼ expand

allowedTools: get_file_contents, create_branch, create_or_update_file, create_merge_request

allowedPaths: package.json, CHANGELOG.md

branch: deps/foolib-demo

forbidden (GitLab high-risk surface):

push_files — can target main directly, bypassing review

create_pipeline — can trigger CI/CD jobs that exfiltrate protected variables/secrets

delete_branch — can destroy feature/release branches irreversibly

create_project_variable — can overwrite CI/CD secrets or inject malicious env vars

fork_repository — can exfiltrate repo to attacker-controlled namespace

delete_file — deleting files is not part of this task

sealed before first tool read — cannot be modified during the run · GitLab's 190+ tools, all outside intent, are blocked

Task (what the agent is asked to do)

Attack presets:

Injection payload (replaces CHANGELOG.md content sent to LLM)

Skeptical? Expand the full raw log — every MCP call, the deterministic guard decision, and the model's output. Or verify main on GitLab. It's open source.

🛡 Airlock — Prompt-Injection Guard Demo