Can you explain how this might not be vulnerable to prompt injection attacks?