What problem does it solve? LLM output is untrusted input: a prompt-injected email can inflate parse confidence, impersonate a party via a model-extracted email address, or fabricate price-affecting fields like weight and dimensions. This Skill codifies the doctrine that model output is advisory only and must never gate auto-actions, bind identity, or set prices without independent deterministic confirmation. ## Core Features & Use Cases - Four hardening rules: model confidence never gates actions, identity keys off the authenticated envelope sender (from_ref) rather than party_hint, auto-send requires deterministic re-extraction that fails closed per price-affecting field, and missing physics queues as UNKNOWN instead of accepting a model guess. - Redelivery purity guidance: redelivery fast-paths re-render from committed events only, pinning config inputs into the message.sent payload and never re-parsing. - Reference checklists: a per-field fail-closed corroboration table (zips, weight, accessorials, dims) and an identity-resolution checklist for new agents. - Use Case: When extending a freight agent that parses inbound emails with an LLM and auto-sends quotes, apply these rules so an injected email cannot trigger an under-priced auto-send or impersonate an existing customer. ## Quick Start Ask the AI to review your agent's auto-send and party-resolution logic against the harden-agent-against-model-trust rules and identify any place where model output gates an action.
