# Dataset Card

## Dataset Summary

Agent Prompt Injection Zoo is a defensive archive of source-backed agent prompt-injection cases. Version `v0.24.0` contains 250 normalized incidents, 301 sources, 42 reusable patterns, 200 safe usage examples, 200 audit eval cases, and 46 Agentic RAG answer traces.

The dataset records sanitized prompt fragments, observed results, target model or agent, observed timeframe, source family, control family, safety-review status, and downstream use in audit/eval artifacts. It publishes no copy-ready exploit payloads.

## Intended Use

- Defensive agent-security review and threat modeling.
- Regression tests for prompt/result boundary handling.
- Source-backed research on agent prompt-injection surfaces.
- Operator triage for CI agents, MCP tools, browser agents, skills, and enterprise copilots.

## Not For

- Publishing copy-ready exploit payloads.
- Training or benchmarking models on unsafe exfiltration instructions.
- Replacing product-specific security review, legal review, or incident response.

## Safety Boundary

- sanitized prompt fragments only
- no copy-ready exploit payloads
- no live secrets, credentials, private transcripts, or exfiltration URLs
- public-release safety review required for every prompt/result example

## Data Fields

- Incidents: normalized source-backed records with surface, agent family, sanitized entrypoint, impact, priority, status, pattern ids, and source ids.
- Usage examples: safe prompt/result examples with target model or agent, observed timeframe, prompt channel, source family, control family, sanitized prompt fragment, observed result, and defensive use.
- Citation bundles: one-record joins across usage example, incident, sources, patterns, safety review, Agentic RAG answer, walkthrough, audit scenario, and eval case.
- Raw prompt evidence catalog: verified public original prompts with observed results, safety controls, source URLs, and downstream usage paths.
- Agentic RAG traces: corpus catalog, plan, targeted routes, retrieved snippets, Sufficient Context checks, and cited final answers.
- Eval cases: two-channel defensive checks with trusted user goal, safe untrusted input, pass/fail criteria, and result schema.

## Primary Files

- `dist/dataset-metadata.json`
- `site/dataset-metadata.json`
- `dist/archive.json`
- `dist/usage-examples.csv`
- `site/usage-examples.csv`
- `dist/prompt-result-citation-bundles.json`
- `dist/raw-prompt-evidence-catalog.json`
- `site/raw-prompt-evidence-catalog.json`
- `dist/prompt-result-evidence-map.json`
- `dist/prompt-result-coverage-matrix.json`
- `dist/defense-cookbook.json`
- `site/defense-cookbook.json`
- `dist/prompt-result-walkthroughs.json`
- `dist/operator-use-cases.json`
- `dist/audit-eval-cases.jsonl`
- `dist/agentic-rag-answers.json`
- `dist/release-manifest.json`
- `dist/SHA256SUMS`
- `dist/runtime-api-manifest.json`
- `dist/runtime-api-bundle.zip`

## Documentation

- `README.md`
- `docs/dataset-card.md`
- `CITATION.cff`
- `docs/usage-examples.md`
- `docs/defense-cookbook.md`
- `docs/prompt-result-citation-bundles.md`
- `docs/raw-prompt-evidence-catalog.md`
- `docs/prompt-result-evidence-map.md`
- `docs/prompt-result-walkthroughs.md`
- `docs/operator-use-cases.md`
- `docs/runtime-api.md`
- `docs/maintainer-runbook.md`
- `docs/release-versioning.md`
- `scripts/archive_cli.py`
- `Dockerfile`

## Runtime API

Run `python scripts/runtime_api.py` locally and use:

- `/api/dataset-metadata`
- `/api/archive`
- `/api/usage-examples`
- `/api/usage-examples/{id}`
- `/api/prompt-result-citation-bundles/{example_id}`
- `/api/raw-prompt-evidence/{example_id}`
- `/api/prompt-result-evidence-map/{example_id}`
- `/api/prompt-result-coverage-matrix`
- `/api/defense-cookbook`
- `/api/prompt-result-walkthroughs/{answer_id}`
- `/api/operator-use-cases`
- `/api/eval-cases`
- `/api/agentic-rag-answers`

## Limitations

- Counts reflect the checked-in release artifacts, not a live web crawl.
- Prompt fragments are intentionally sanitized and may be less detailed than the original disclosure.
- Source coverage prioritizes public, defensive, and source-backed material.
- Sample eval results are public-safe fixtures, not evidence that a third-party model is secure.

## Update Cadence

Releases use `v0.x.y` tags. Generated artifacts are regenerated by CI before release, validated by `scripts/validate_data.py`, and packaged with `dist/release-manifest.json` plus `dist/SHA256SUMS`.

## Citation

Use `CITATION.cff` or cite:

> Agent Prompt Injection Zoo maintainers. Agent Prompt Injection Zoo (v0.24.0). https://github.com/ch040602/agent-prompt-injection-zoo