APPENDIX H: RESUME PORTFOLIO BUILDING CAPSTONE PROJECTS

HOW TO PRESENT IT IN A PORTFOLIO README outline Title and purpose, using the phrase prompt injection defense. A plain-language threat story: the clerk and the sneaky sentence. An architecture diagram in text showing agent, defenses, client, and server. How to run the attack with defenses off and on. A table in plain sentences listing each defense and the threat it answers. How to run the tests. Honest limits, stating that the server is a simplified MCP-style teaching server and that phrase scanning is incomplete. Next steps. What to screenshot or record Take a screenshot of the unsafe run showing delete_item succeeded. Take a screenshot of the safe run showing the quarantine. Take a screenshot of ALL TESTS PASSED. Record a short video showing the same task run twice, once with defenses off and once with them on, narrated in plain words. Metrics to report honestly Report the number of attack cases you tested and how many were stopped, for example two of two, and say exactly which defense stopped each one. Report any attack you could think of that your system does not stop, because naming a known gap is a sign of maturity. Say that the results use an invented catalog and a gullible mock model. How to word a resume bullet truthfully Good example: "Built a Python tool agent with a separate JSON-RPC tool server, tool allowlist, argument validation, injection quarantine, and human approval for destructive actions; demonstrated and tested a prompt-injection scenario with defenses on and off." Another good example: "Wrote an audit log and automated tests for an agent that must treat tool output as untrusted data." Avoid saying "secured against prompt injection," because it overstates what the project proves. Interview talking points Explain the difference between information and instructions, using the careful clerk story. Explain why a model should not be trusted to police itself. Explain each defense layer and what it would miss. Explain why destructive actions need a human in the loop. Explain what you would add for a real MCP server, such as server vetting and pinned versions.