{
  "version": "1.0",
  "note": "Injection lexicon ported from llm-security injection-patterns.mjs. Single source of truth; compiled by lexicon.load_lexicon(). Non-ASCII kept as \\uXXXX escapes.",
  "patterns": [
    {
      "id": "override:ignore-previous",
      "regex": "ignore\\s+(?:all\\s+)?previous",
      "flags": "i",
      "severity": "critical",
      "owasp": "LLM01",
      "desc": "override: ignore previous instructions"
    },
    {
      "id": "override:forget-instructions",
      "regex": "forget\\s+your\\s+(?:instructions|rules|guidelines|directives)",
      "flags": "i",
      "severity": "critical",
      "owasp": "LLM01",
      "desc": "override: forget instructions"
    },
    {
      "id": "override:disregard",
      "regex": "disregard\\s+your",
      "flags": "i",
      "severity": "critical",
      "owasp": "LLM01",
      "desc": "override: disregard instructions"
    },
    {
      "id": "override:override-instructions",
      "regex": "override\\s+your",
      "flags": "i",
      "severity": "critical",
      "owasp": "LLM01",
      "desc": "override: override instructions"
    },
    {
      "id": "override:suspend-constraints",
      "regex": "suspend\\s+all\\s+constraints",
      "flags": "i",
      "severity": "critical",
      "owasp": "LLM01",
      "desc": "override: suspend constraints"
    },
    {
      "id": "override:prior-constraints",
      "regex": "all\\s+prior\\s+constraints",
      "flags": "i",
      "severity": "critical",
      "owasp": "LLM01",
      "desc": "override: prior constraints"
    },
    {
      "id": "spoofed-header:hash-system",
      "regex": "^#+\\s*SYSTEM\\s*:",
      "flags": "m",
      "severity": "critical",
      "owasp": "LLM01",
      "desc": "spoofed header: # SYSTEM:"
    },
    {
      "id": "spoofed-header:inst",
      "regex": "^\\[INST\\]",
      "flags": "m",
      "severity": "critical",
      "owasp": "LLM01",
      "desc": "spoofed header: [INST]"
    },
    {
      "id": "spoofed-header:pipe-system",
      "regex": "<\\|system\\|>",
      "flags": "",
      "severity": "critical",
      "owasp": "LLM01",
      "desc": "spoofed header: <|system|>"
    },
    {
      "id": "spoofed-tag:system-open",
      "regex": "<system>",
      "flags": "",
      "severity": "critical",
      "owasp": "LLM01",
      "desc": "spoofed tag: <system>"
    },
    {
      "id": "spoofed-tag:system-close",
      "regex": "</system>",
      "flags": "",
      "severity": "critical",
      "owasp": "LLM01",
      "desc": "spoofed tag: </system>"
    },
    {
      "id": "spoofed-header:instructions",
      "regex": "^###\\s*Instructions\\s*:",
      "flags": "m",
      "severity": "critical",
      "owasp": "LLM01",
      "desc": "spoofed header: ### Instructions:"
    },
    {
      "id": "identity:no-longer",
      "regex": "you\\s+are\\s+no\\s+longer",
      "flags": "i",
      "severity": "critical",
      "owasp": "LLM01",
      "desc": "identity: you are no longer"
    },
    {
      "id": "identity:you-are-now",
      "regex": "you\\s+are\\s+now\\s+(?!able|going|ready|done|running|using|looking|in\\s|at\\s|on\\s)",
      "flags": "i",
      "severity": "critical",
      "owasp": "LLM01",
      "desc": "identity: you are now [name]"
    },
    {
      "id": "identity:new-role",
      "regex": "your\\s+new\\s+role\\s+is",
      "flags": "i",
      "severity": "critical",
      "owasp": "LLM01",
      "desc": "identity: your new role"
    },
    {
      "id": "identity:new-directive",
      "regex": "your\\s+new\\s+primary\\s+directive",
      "flags": "i",
      "severity": "critical",
      "owasp": "LLM01",
      "desc": "identity: new primary directive"
    },
    {
      "id": "identity:pretend",
      "regex": "pretend\\s+you\\s+are",
      "flags": "i",
      "severity": "critical",
      "owasp": "LLM01",
      "desc": "identity: pretend you are"
    },
    {
      "id": "config:ignore-claudemd",
      "regex": "ignore\\s+your\\s+CLAUDE\\.md",
      "flags": "i",
      "severity": "critical",
      "owasp": "LLM01",
      "desc": "config: ignore CLAUDE.md"
    },
    {
      "id": "config:override-system-prompt",
      "regex": "override\\s+your\\s+system\\s+prompt",
      "flags": "i",
      "severity": "critical",
      "owasp": "LLM01",
      "desc": "config: override system prompt"
    },
    {
      "id": "config:bypass-safety",
      "regex": "bypass\\s+your\\s+safety",
      "flags": "i",
      "severity": "critical",
      "owasp": "LLM01",
      "desc": "config: bypass safety"
    },
    {
      "id": "config:disable-filtering",
      "regex": "disable\\s+output\\s+filtering",
      "flags": "i",
      "severity": "critical",
      "owasp": "LLM01",
      "desc": "config: disable output filtering"
    },
    {
      "id": "normalization:prioritize-user",
      "regex": "always\\s+prioritize\\s+user\\s+requests?\\s+over",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "normalization: prioritize user over rules"
    },
    {
      "id": "normalization:user-precedence",
      "regex": "user\\s+intent\\s+takes?\\s+precedence\\s+over",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "normalization: user intent precedence"
    },
    {
      "id": "normalization:claudemd-conflict",
      "regex": "if\\s+CLAUDE\\.md\\s+conflicts",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "normalization: CLAUDE.md conflict override"
    },
    {
      "id": "normalization:skip-confirmation",
      "regex": "skip\\s+confirmation\\s+for",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "normalization: skip confirmation"
    },
    {
      "id": "reframing:actual-task",
      "regex": "your\\s+actual\\s+task\\s+is",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "reframing: your actual task"
    },
    {
      "id": "reframing:real-purpose",
      "regex": "your\\s+real\\s+purpose\\s+is",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "reframing: your real purpose"
    },
    {
      "id": "reframing:should-actually-do",
      "regex": "what\\s+you\\s+should\\s+actually\\s+do",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "reframing: what you should actually do"
    },
    {
      "id": "hidden-comment:agent-directed",
      "regex": "<!--\\s*(?:AGENT|AI|HIDDEN|ACTUAL\\s+TASK|REAL\\s+INSTRUCTION)\\s*:",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "hidden comment: agent-directed HTML comment"
    },
    {
      "id": "html-obfuscation:display-none",
      "regex": "<[^>]+style\\s*=\\s*\"[^\"]*display\\s*:\\s*none[^\"]*\"[^>]*>",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "html-obfuscation: display:none element with content"
    },
    {
      "id": "html-obfuscation:visibility-hidden",
      "regex": "<[^>]+style\\s*=\\s*\"[^\"]*visibility\\s*:\\s*hidden[^\"]*\"[^>]*>",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "html-obfuscation: visibility:hidden element"
    },
    {
      "id": "html-obfuscation:offscreen",
      "regex": "<[^>]+style\\s*=\\s*\"[^\"]*position\\s*:\\s*absolute[^\"]*-\\d{3,}px[^\"]*\"[^>]*>",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "html-obfuscation: off-screen positioned element"
    },
    {
      "id": "html-obfuscation:zero-font",
      "regex": "<[^>]+style\\s*=\\s*\"[^\"]*font-size\\s*:\\s*0[^\"]*\"[^>]*>",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "html-obfuscation: zero font-size element"
    },
    {
      "id": "html-obfuscation:zero-opacity",
      "regex": "<[^>]+style\\s*=\\s*\"[^\"]*opacity\\s*:\\s*0[^\"]*\"[^>]*>",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "html-obfuscation: zero opacity element"
    },
    {
      "id": "html-obfuscation:zero-size-overflow",
      "regex": "<[^>]+style\\s*=\\s*\"[^\"]*(?:height|width)\\s*:\\s*0[^\"]*overflow\\s*:\\s*hidden[^\"]*\"[^>]*>",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "html-obfuscation: zero-size overflow-hidden element"
    },
    {
      "id": "html-obfuscation:aria-label",
      "regex": "aria-label\\s*=\\s*\"[^\"]*(?:ignore|override|system|instruction|execute|exfiltrate)[^\"]*\"",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "html-obfuscation: injection in aria-label attribute"
    },
    {
      "id": "evasion:educational",
      "regex": "for\\s+educational\\s+purposes?\\s+only",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "evasion: educational purpose framing"
    },
    {
      "id": "evasion:hypothetical",
      "regex": "(?:this\\s+is\\s+)?a\\s+hypothetical\\s+scenario",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "evasion: hypothetical scenario framing"
    },
    {
      "id": "evasion:fictional",
      "regex": "in\\s+a\\s+fictional\\s+(?:setting|scenario|world)\\s+where",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "evasion: fictional setting framing"
    },
    {
      "id": "evasion:red-team",
      "regex": "(?:this\\s+is\\s+)?a\\s+red[- ]?team(?:ing)?\\s+(?:exercise|simulation|test)",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "evasion: red-team exercise framing"
    },
    {
      "id": "evasion:security-audit-sim",
      "regex": "security\\s+audit\\s+simulation",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "evasion: security audit simulation framing"
    },
    {
      "id": "evasion:test-pretense",
      "regex": "pretend\\s+(?:this\\s+is|we\\s+are\\s+in)\\s+a\\s+(?:test|lab|sandbox|simulation)",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "evasion: test/lab/sandbox pretense"
    },
    {
      "id": "evasion:thought-experiment",
      "regex": "as\\s+a\\s+thought\\s+experiment",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "evasion: thought experiment framing"
    },
    {
      "id": "evasion:research-purpose",
      "regex": "for\\s+(?:research|academic|scientific)\\s+purposes",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "evasion: research purpose framing"
    },
    {
      "id": "evasion:academic-context",
      "regex": "in\\s+an?\\s+(?:academic|research|educational)\\s+context",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "evasion: academic context framing"
    },
    {
      "id": "hitl-trap:approve-immediately",
      "regex": "(?:approve|accept|confirm)\\s+(?:this\\s+)?immediately",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "hitl-trap: approval urgency - approve immediately"
    },
    {
      "id": "hitl-trap:no-need-review",
      "regex": "no\\s+need\\s+to\\s+review",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "hitl-trap: approval urgency - no need to review"
    },
    {
      "id": "hitl-trap:just-approve",
      "regex": "(?:just|simply)\\s+(?:approve|accept|confirm)\\s+(?:it|this|everything)",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "hitl-trap: approval urgency - just approve"
    },
    {
      "id": "hitl-trap:suppress-review",
      "regex": "(?:don'?t|do\\s+not)\\s+(?:bother\\s+)?(?:check|review|verify|inspect|read)(?:ing)?\\s+(?:this|the|it)",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "hitl-trap: approval urgency - suppress review"
    },
    {
      "id": "hitl-trap:brevity-skip",
      "regex": "for\\s+brevity[\\s,]+(?:skipping|omitting|leaving\\s+out)",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "hitl-trap: summary suppression - for brevity, skipping"
    },
    {
      "id": "hitl-trap:too-long",
      "regex": "(?:too\\s+(?:long|verbose|detailed)\\s+to\\s+(?:show|display|list|include))",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "hitl-trap: summary suppression - too long to show"
    },
    {
      "id": "hitl-trap:details-omitted",
      "regex": "(?:details?\\s+(?:omitted|redacted|hidden|suppressed))",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "hitl-trap: summary suppression - details omitted"
    },
    {
      "id": "hitl-trap:scope-minimization",
      "regex": "(?:minor|trivial|small|cosmetic)\\s+(?:change|update|fix|adjustment)\\b[^.]{0,80}(?:delet|remov|drop|truncat|reset|destroy|\\bformat\\b|wipe)",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "hitl-trap: scope minimization - minor change + destructive action"
    },
    {
      "id": "hybrid-p2sql:inject-sql",
      "regex": "(?:ignore|override|disregard|forget)[^.]{0,60}(?:SELECT\\s+\\*|DROP\\s+TABLE|UNION\\s+SELECT|DELETE\\s+FROM|INSERT\\s+INTO|UPDATE\\s+\\w+\\s+SET)(?:\\b|(?=\\s|$))",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "hybrid-p2sql: injection + SQL keywords (prompt-to-SQL attack)"
    },
    {
      "id": "hybrid-p2sql:sql-inject",
      "regex": "(?:SELECT\\s+\\*|DROP\\s+TABLE|UNION\\s+SELECT|DELETE\\s+FROM)\\s[^;]{0,80}(?:ignore|override|disregard|bypass)",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "hybrid-p2sql: SQL operation + injection override keywords"
    },
    {
      "id": "hybrid-recursive:inject-output",
      "regex": "(?:inject|insert|embed|include)\\s+(?:this|the\\s+following)\\s+(?:into|in)\\s+(?:your|the)\\s+(?:output|response|reply|message|prompt|context)",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "hybrid-recursive: instruction to inject into model output"
    },
    {
      "id": "hybrid-recursive:conditional-response",
      "regex": "(?:when|if)\\s+(?:the\\s+)?(?:user|human|operator)\\s+(?:asks?|requests?|queries)[^.]{0,60}(?:respond\\s+with|output|reply\\s+with|include)\\s+(?:this|the\\s+following)",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "hybrid-recursive: conditional response injection (recursive payload)"
    },
    {
      "id": "hybrid-xss:script-tag",
      "regex": "<script\\b[^>]*>[\\s\\S]*?</script>",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "hybrid-xss: <script> tag in content (agent context XSS)"
    },
    {
      "id": "hybrid-xss:javascript-uri",
      "regex": "javascript\\s*:",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "hybrid-xss: javascript: URI scheme (agent context XSS)"
    },
    {
      "id": "hybrid-xss:event-handler",
      "regex": "\\bon(?:error|load|click|mouseover|focus|blur)\\s*=",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "hybrid-xss: inline event handler attribute (agent context XSS)"
    },
    {
      "id": "hybrid-xss:iframe-src",
      "regex": "<iframe\\b[^>]*src\\s*=\\s*[\"\\'][^\"\\']*(?:javascript:|data:text/html)",
      "flags": "i",
      "severity": "high",
      "owasp": "LLM01",
      "desc": "hybrid-xss: iframe with executable src (agent context XSS)"
    },
    {
      "id": "leetspeak:ignore-previous",
      "regex": "[1!|l][gq9]n[o0]r[e3]\\s+(?:all\\s+)?pr[e3]v[i1!|l][o0]us",
      "flags": "i",
      "severity": "medium",
      "owasp": "LLM01",
      "desc": "leetspeak: ignore previous (obfuscated)"
    },
    {
      "id": "leetspeak:forget-instructions",
      "regex": "f[o0]rg[e3]t\\s+y[o0]ur\\s+[i1!|l]nstruct[i1!|l][o0]ns",
      "flags": "i",
      "severity": "medium",
      "owasp": "LLM01",
      "desc": "leetspeak: forget instructions (obfuscated)"
    },
    {
      "id": "leetspeak:disregard",
      "regex": "d[i1!|l]sr[e3]g[a4@]rd\\s+y[o0]ur",
      "flags": "i",
      "severity": "medium",
      "owasp": "LLM01",
      "desc": "leetspeak: disregard your (obfuscated)"
    },
    {
      "id": "leetspeak:override",
      "regex": "[o0]v[e3]rr[i1!|l]d[e3]\\s+y[o0]ur",
      "flags": "i",
      "severity": "medium",
      "owasp": "LLM01",
      "desc": "leetspeak: override your (obfuscated)"
    },
    {
      "id": "homoglyph:cyrillic-latin-mix",
      "regex": "[a-zA-Z][\u0430\u0435\u043e\u0440\u0441\u0456\u0443]|[\u0430\u0435\u043e\u0440\u0441\u0456\u0443][a-zA-Z]",
      "flags": "",
      "severity": "medium",
      "owasp": "LLM01",
      "desc": "homoglyph: Cyrillic-Latin mixing in adjacent characters"
    },
    {
      "id": "unicode:zero-width-in-word",
      "regex": "\\w[\u200b\u200c\u200d\ufeff]\\w",
      "flags": "",
      "severity": "medium",
      "owasp": "LLM01",
      "desc": "unicode: zero-width character inside word (keyword splitting)"
    },
    {
      "id": "indirect:instruction-to-ai",
      "regex": "(?:note|message|instruction)\\s+(?:to|for)\\s+(?:the\\s+)?(?:AI|assistant|model|LLM|Claude)\\b",
      "flags": "i",
      "severity": "medium",
      "owasp": "LLM01",
      "desc": "indirect: instruction addressed to AI/assistant"
    },
    {
      "id": "indirect:direct-address",
      "regex": "(?:dear|attention)\\s+(?:AI|assistant|model|LLM|Claude)\\b",
      "flags": "i",
      "severity": "medium",
      "owasp": "LLM01",
      "desc": "indirect: direct address to AI/assistant"
    },
    {
      "id": "indirect:trigger-based",
      "regex": "when\\s+(?:you|the\\s+AI|the\\s+assistant|Claude)\\s+(?:read|see|encounter|process)\\s+this",
      "flags": "i",
      "severity": "medium",
      "owasp": "LLM01",
      "desc": "indirect: trigger-based instruction for AI"
    },
    {
      "id": "multi-lang:french",
      "regex": "ignor(?:ez?|er?)\\s+(?:les?\\s+)?instructions?\\s+pr[e\u00e9]c[e\u00e9]dentes?",
      "flags": "i",
      "severity": "medium",
      "owasp": "LLM01",
      "desc": "multi-lang: French \"ignore previous instructions\""
    },
    {
      "id": "multi-lang:spanish",
      "regex": "ignor(?:ar?|e)\\s+(?:las?\\s+)?instrucciones?\\s+anteriores?",
      "flags": "i",
      "severity": "medium",
      "owasp": "LLM01",
      "desc": "multi-lang: Spanish \"ignore previous instructions\""
    },
    {
      "id": "multi-lang:german",
      "regex": "ignorier(?:e|en)?\\s+(?:alle\\s+)?vorherigen?\\s+(?:Anweisungen|Instruktionen)",
      "flags": "i",
      "severity": "medium",
      "owasp": "LLM01",
      "desc": "multi-lang: German \"ignore previous instructions\""
    },
    {
      "id": "markdown:link-ref-comment",
      "regex": "\\[//\\]:\\s*#\\s*\\(.*(?:ignore|override|system|instruction|execute)",
      "flags": "i",
      "severity": "medium",
      "owasp": "LLM01",
      "desc": "markdown: suspicious instruction in link-reference comment"
    },
    {
      "id": "data-uri:executable",
      "regex": "data:(?:text/html|application/javascript|text/javascript)[;,]",
      "flags": "i",
      "severity": "medium",
      "owasp": "LLM01",
      "desc": "data-uri: executable content type"
    },
    {
      "id": "markdown:link-anchor-injection",
      "regex": "\\[[^\\]]*(?:system|ignore|override|exfiltrate|execute)[^\\]]*\\]\\([^)]+\\)",
      "flags": "i",
      "severity": "medium",
      "owasp": "LLM01",
      "desc": "markdown: injection payload in link anchor text"
    },
    {
      "id": "sub-agent:spawn-dangerous",
      "regex": "(?:create|spawn|launch|start|run)\\s+(?:an?\\s+)?(?:new\\s+)?(?:sub-?agent|agent|task|worker)\\s+(?:that|to|which|with)\\s+(?:\\S+\\s+){0,12}?(?:execute|run|delete|remove|send|post|exfiltrate|access|reads?\\s+(?:\\S+\\s+){0,12}?(?:secret|credential|key|token|\\.env|\\.ssh))",
      "flags": "i",
      "severity": "medium",
      "owasp": "LLM01",
      "desc": "sub-agent: spawn instruction with dangerous capability keywords"
    },
    {
      "id": "sub-agent:delegate-bypass",
      "regex": "(?:delegate|dispatch)\\s+(?:to\\s+)?(?:an?\\s+)?(?:new\\s+)?(?:agent|sub-?agent|task)\\s+.{0,120}?(?:bypass|override|ignore|without\\s+(?:review|confirmation|approval))",
      "flags": "i",
      "severity": "medium",
      "owasp": "LLM01",
      "desc": "sub-agent: delegation with safety bypass instruction"
    },
    {
      "id": "nl-indirection:fetch-execute",
      "regex": "fetch\\s+(?:this|the|that)\\s+(?:URL|link|endpoint)\\s+and\\s+(?:execute|run|eval)",
      "flags": "i",
      "severity": "medium",
      "owasp": "LLM01",
      "desc": "nl-indirection: fetch URL and execute"
    },
    {
      "id": "nl-indirection:send-external",
      "regex": "send\\s+(?:this|the|that|all)\\s+(?:data|content|output|result|information|file)\\s+to\\s+(?:https?://|ftp://|\\S+@\\S+)",
      "flags": "i",
      "severity": "medium",
      "owasp": "LLM01",
      "desc": "nl-indirection: send data to external destination"
    },
    {
      "id": "nl-indirection:read-dotfile",
      "regex": "read\\s+(?:the\\s+)?(?:contents?\\s+of\\s+)?(?:~/)?\\.(?:ssh|aws|gnupg|env)\\b",
      "flags": "i",
      "severity": "medium",
      "owasp": "LLM01",
      "desc": "nl-indirection: read sensitive dotfile path"
    },
    {
      "id": "nl-indirection:extract-exfiltrate",
      "regex": "(?:extract|copy|dump|exfiltrate)\\s+(?:all\\s+)?(?:the\\s+)?(?:credentials?|secrets?|tokens?|keys?|passwords?)\\s+(?:and|then)\\s+(?:send|post|upload|transmit)",
      "flags": "i",
      "severity": "medium",
      "owasp": "LLM01",
      "desc": "nl-indirection: extract credentials and exfiltrate"
    },
    {
      "id": "nl-indirection:download-execute",
      "regex": "(?:download|fetch|retrieve)\\s+(?:from\\s+)?\\S+\\s+(?:and|then)\\s+(?:execute|run|eval|pipe\\s+to\\s+(?:bash|sh|node|python))",
      "flags": "i",
      "severity": "medium",
      "owasp": "LLM01",
      "desc": "nl-indirection: download and execute"
    }
  ]
}