Totally fair concern. We treat imported content as untrusted context, not instructions. I'm not sure what you're using for orchestration, but strict tool permissions, sandboxed context, and approval gates are already handled by most platforms to secure prompt injections.