Reachability-Based Capability Confinement for LLM Agents under Indirect Prompt Injection
SkillGuard is presented, a harness-level enforcement layer that treats this event as contamination and restricts future capabilities to disconnect the resulting state from deployer-defined forbidden states and preserves substantially more capabilities than binary restriction at the same attack success rate.