I’d like to point, yet again, that for custom prompts users must use the custom prompt input.
Using the content itself to inject instructions may work today, as the current crop of LLMs is very susceptible to those injection attacks, but it’s not a sustainable approach we recommend as it will invariably stop working in the future and lead to broken workflows.