[greshake]

You're missing the more important vector for prompt injection: Indirect injection through the "search engine context". It's not just a matter of blocking bad user questions to fend off reputational harms. See also my work on https://kai-greshake.de/

[greshake]

(depending on whether the search engine context is connected to untrusted inputs or only your curated database ofc)