I think prompt injection malware is legal and OK because the prompt itself does not take any action, ergo the prompt can not be held accountable for what it might cause