---
title: "Check files and images before the model · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-features/guardrails-and-human-review/model-file-inputs
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Check files and images before the model reads them

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Guardrails and human review](https://agentwranglers.se/playbook/ai-features/guardrails-and-human-review.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- ID: AIF-57
- Level: Recommended
- Chapter: [Guardrails and human review](https://agentwranglers.se/playbook/ai-features/guardrails-and-human-review)
- Rule: Check the type, size and page count of every file, image or audio clip before it reaches a model. Rebuild images first, and treat any text inside a file as untrusted input.
- Applies when: The project uses AI models.
- How: Accept only the types the feature needs, such as PNG, JPEG and PDF. Check the file's first bytes, not its name. Set limits below the provider's own, such as 5 MB per image and 20 pages per PDF. Reject larger files with a clear message. Rebuild every image as [rebuild every uploaded image](https://agentwranglers.se/playbook/api-design/files-and-uploads/process-images) says, which drops EXIF location data before it leaves your servers. Scale images down to the size the task needs, because image tokens count toward the [token budget](https://agentwranglers.se/playbook/ai-features/latency-cost-and-fallbacks/context-budget). Text in an image or a PDF can carry hidden instructions, as the OWASP entry on prompt injection shows. Give the model no more power after reading a file than [resist indirect prompt injection](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/indirect-prompt-injection) allows.
- Check: Unit tests send a renamed program file, a 30-page PDF and a photo with GPS tags. The first two get a clear error with no model call. The photo reaches the fake provider with no EXIF data and its long side at or under the set limit.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### TypeScript example

```ts
const ALLOWED_TYPES = new Set(['image/png', 'image/jpeg', 'application/pdf']);
const MAX_IMAGE_BYTES = 5 * 1024 * 1024;
const MAX_PDF_PAGES = 20;

export async function checkModelFile(bytes: Buffer): Promise<string | null> {
  const type = (await fileTypeFromBuffer(bytes))?.mime;
  if (!type || !ALLOWED_TYPES.has(type)) return 'unsupported_type';
  if (type === 'application/pdf') return (await pdfPageCount(bytes)) > MAX_PDF_PAGES ? 'too_many_pages' : null;
  return bytes.length > MAX_IMAGE_BYTES ? 'too_large' : null;
}
```

### Python example

```python
ALLOWED_TYPES = {"image/png", "image/jpeg", "application/pdf"}
MAX_IMAGE_BYTES = 5 * 1024 * 1024
MAX_PDF_PAGES = 20

def check_model_file(data: bytes) -> str | None:
    kind = filetype.guess(data)
    if kind is None or kind.mime not in ALLOWED_TYPES:
        return "unsupported_type"
    if kind.mime == "application/pdf":
        return "too_many_pages" if len(PdfReader(io.BytesIO(data)).pages) > MAX_PDF_PAGES else None
    return "too_large" if len(data) > MAX_IMAGE_BYTES else None
```

## Sources

- [OWASP LLM01:2025 Prompt Injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/)

## Related rules

- [Test prompt injection in every file type the model reads](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/file-prompt-injection) in Security testing
- [Rebuild every uploaded image](https://agentwranglers.se/playbook/api-design/files-and-uploads/process-images) in API design
- [Keep every request inside a token budget](https://agentwranglers.se/playbook/ai-features/latency-cost-and-fallbacks/context-budget) in AI features
- [Resist indirect prompt injection](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/indirect-prompt-injection) in Security testing

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/ai-features/guardrails-and-human-review/model-file-inputs">Agent Wranglers AI features playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Check input before it reaches the model](https://agentwranglers.se/playbook/ai-features/guardrails-and-human-review/input-checks)
- Next: [Check output before anyone sees it](https://agentwranglers.se/playbook/ai-features/guardrails-and-human-review/output-checks)
- [Guardrails and human review](https://agentwranglers.se/playbook/ai-features/guardrails-and-human-review)