Author here. Thanks for flagging this, it was indeed unclear. I'm glad others have managed to clarify it for you (thanks all!). I've tweaked the wording here and also highlighted the prompt injection explicitly to make this clearer.