open/llm-ingestion-pipeline-security
1
0
Fork 0
Code Issues Releases 4 Activity
llm-ingestion-pipeline-secu.../src/llm_ingestion_guard/injection_lexicon.json
Kjell Tore Guttormsen f397cd94e1 feat(lexicon): JSON injection lexicon + variant-set scan (TDD) [skip-docs] 
Build order step 4 — the load-bearing port from the llm-security seed
(injection-patterns.mjs + string-utils.mjs), stdlib-only.

- injection_lexicon.json: 83 patterns (CRITICAL/HIGH/HYBRID/MEDIUM) as the
  single source of truth (regex + id + severity + owasp + desc), compiled once
  by a thin loader. Decoupled from the engine for a future TS port.
- scan_lexicon(text, source, max_scan_chars) -> Report: matches every pattern
  against a deduped variant set (raw / normalized / homoglyph-folded / rot13),
  plus unicode-tag presence signal and the cognitive-load trap.
- normalize_for_scan chain ported: unicode-tags -> bidi -> HTML-entities ->
  unicode/hex/URL escapes -> whole-string base64 (reuses entropy.try_decode_base64)
  -> collapse letter-spacing; plus fold_homoglyphs / rot13.
- Self-safety (OWASP LLM10): input-size cap (scan prefix + flag oversize) and
  ReDoS-safe port — the two nested-.*? sub-agent patterns bounded to
  (?:\S+\s+){0,N}?; verified true positives still fire.
- Non-Latin data (homoglyph map, BIDI block) built from explicit code points;
  JSON non-ASCII kept as \uXXXX escapes.

24 tests; 55 green total.

[skip-docs]: README positioning + honest-limitations is a deliberate build-order
step-11 deliverable (steps 1-3 likewise left README frozen). README status line
("pre-implementation") is stale and flagged for the step-11 refresh.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01K8GmKRCdsPjWYAKWsNgeQS
2026-07-04 17:20:21 +02:00

670 lines
22 KiB
JSON
Raw Blame History

{
"version": "1.0",
"note": "Injection lexicon ported from llm-security injection-patterns.mjs. Single source of truth; compiled by lexicon.load_lexicon(). Non-ASCII kept as \\uXXXX escapes.",
"patterns": [
{
"id": "override:ignore-previous",
"regex": "ignore\\s+(?:all\\s+)?previous",
"flags": "i",
"severity": "critical",
"owasp": "LLM01",
"desc": "override: ignore previous instructions"
},
{
"id": "override:forget-instructions",
"regex": "forget\\s+your\\s+(?:instructions|rules|guidelines|directives)",
"flags": "i",
"severity": "critical",
"owasp": "LLM01",
"desc": "override: forget instructions"
},
{
"id": "override:disregard",
"regex": "disregard\\s+your",
"flags": "i",
"severity": "critical",
"owasp": "LLM01",
"desc": "override: disregard instructions"
},
{
"id": "override:override-instructions",
"regex": "override\\s+your",
"flags": "i",
"severity": "critical",
"owasp": "LLM01",
"desc": "override: override instructions"
},
{
"id": "override:suspend-constraints",
"regex": "suspend\\s+all\\s+constraints",
"flags": "i",
"severity": "critical",
"owasp": "LLM01",
"desc": "override: suspend constraints"
},
{
"id": "override:prior-constraints",
"regex": "all\\s+prior\\s+constraints",
"flags": "i",
"severity": "critical",
"owasp": "LLM01",
"desc": "override: prior constraints"
},
{
"id": "spoofed-header:hash-system",
"regex": "^#+\\s*SYSTEM\\s*:",
"flags": "m",
"severity": "critical",
"owasp": "LLM01",
"desc": "spoofed header: # SYSTEM:"
},
{
"id": "spoofed-header:inst",
"regex": "^\\[INST\\]",
"flags": "m",
"severity": "critical",
"owasp": "LLM01",
"desc": "spoofed header: [INST]"
},
{
"id": "spoofed-header:pipe-system",
"regex": "<\\|system\\|>",
"flags": "",
"severity": "critical",
"owasp": "LLM01",
"desc": "spoofed header: <|system|>"
},
{
"id": "spoofed-tag:system-open",
"regex": "<system>",
"flags": "",
"severity": "critical",
"owasp": "LLM01",
"desc": "spoofed tag: <system>"
},
{
"id": "spoofed-tag:system-close",
"regex": "</system>",
"flags": "",
"severity": "critical",
"owasp": "LLM01",
"desc": "spoofed tag: </system>"
},
{
"id": "spoofed-header:instructions",
"regex": "^###\\s*Instructions\\s*:",
"flags": "m",
"severity": "critical",
"owasp": "LLM01",
"desc": "spoofed header: ### Instructions:"
},
{
"id": "identity:no-longer",
"regex": "you\\s+are\\s+no\\s+longer",
"flags": "i",
"severity": "critical",
"owasp": "LLM01",
"desc": "identity: you are no longer"
},
{
"id": "identity:you-are-now",
"regex": "you\\s+are\\s+now\\s+(?!able|going|ready|done|running|using|looking|in\\s|at\\s|on\\s)",
"flags": "i",
"severity": "critical",
"owasp": "LLM01",
"desc": "identity: you are now [name]"
},
{
"id": "identity:new-role",
"regex": "your\\s+new\\s+role\\s+is",
"flags": "i",
"severity": "critical",
"owasp": "LLM01",
"desc": "identity: your new role"
},
{
"id": "identity:new-directive",
"regex": "your\\s+new\\s+primary\\s+directive",
"flags": "i",
"severity": "critical",
"owasp": "LLM01",
"desc": "identity: new primary directive"
},
{
"id": "identity:pretend",
"regex": "pretend\\s+you\\s+are",
"flags": "i",
"severity": "critical",
"owasp": "LLM01",
"desc": "identity: pretend you are"
},
{
"id": "config:ignore-claudemd",
"regex": "ignore\\s+your\\s+CLAUDE\\.md",
"flags": "i",
"severity": "critical",
"owasp": "LLM01",
"desc": "config: ignore CLAUDE.md"
},
{
"id": "config:override-system-prompt",
"regex": "override\\s+your\\s+system\\s+prompt",
"flags": "i",
"severity": "critical",
"owasp": "LLM01",
"desc": "config: override system prompt"
},
{
"id": "config:bypass-safety",
"regex": "bypass\\s+your\\s+safety",
"flags": "i",
"severity": "critical",
"owasp": "LLM01",
"desc": "config: bypass safety"
},
{
"id": "config:disable-filtering",
"regex": "disable\\s+output\\s+filtering",
"flags": "i",
"severity": "critical",
"owasp": "LLM01",
"desc": "config: disable output filtering"
},
{
"id": "normalization:prioritize-user",
"regex": "always\\s+prioritize\\s+user\\s+requests?\\s+over",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "normalization: prioritize user over rules"
},
{
"id": "normalization:user-precedence",
"regex": "user\\s+intent\\s+takes?\\s+precedence\\s+over",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "normalization: user intent precedence"
},
{
"id": "normalization:claudemd-conflict",
"regex": "if\\s+CLAUDE\\.md\\s+conflicts",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "normalization: CLAUDE.md conflict override"
},
{
"id": "normalization:skip-confirmation",
"regex": "skip\\s+confirmation\\s+for",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "normalization: skip confirmation"
},
{
"id": "reframing:actual-task",
"regex": "your\\s+actual\\s+task\\s+is",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "reframing: your actual task"
},
{
"id": "reframing:real-purpose",
"regex": "your\\s+real\\s+purpose\\s+is",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "reframing: your real purpose"
},
{
"id": "reframing:should-actually-do",
"regex": "what\\s+you\\s+should\\s+actually\\s+do",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "reframing: what you should actually do"
},
{
"id": "hidden-comment:agent-directed",
"regex": "<!--\\s*(?:AGENT|AI|HIDDEN|ACTUAL\\s+TASK|REAL\\s+INSTRUCTION)\\s*:",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "hidden comment: agent-directed HTML comment"
},
{
"id": "html-obfuscation:display-none",
"regex": "<[^>]+style\\s*=\\s*\"[^\"]*display\\s*:\\s*none[^\"]*\"[^>]*>",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "html-obfuscation: display:none element with content"
},
{
"id": "html-obfuscation:visibility-hidden",
"regex": "<[^>]+style\\s*=\\s*\"[^\"]*visibility\\s*:\\s*hidden[^\"]*\"[^>]*>",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "html-obfuscation: visibility:hidden element"
},
{
"id": "html-obfuscation:offscreen",
"regex": "<[^>]+style\\s*=\\s*\"[^\"]*position\\s*:\\s*absolute[^\"]*-\\d{3,}px[^\"]*\"[^>]*>",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "html-obfuscation: off-screen positioned element"
},
{
"id": "html-obfuscation:zero-font",
"regex": "<[^>]+style\\s*=\\s*\"[^\"]*font-size\\s*:\\s*0[^\"]*\"[^>]*>",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "html-obfuscation: zero font-size element"
},
{
"id": "html-obfuscation:zero-opacity",
"regex": "<[^>]+style\\s*=\\s*\"[^\"]*opacity\\s*:\\s*0[^\"]*\"[^>]*>",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "html-obfuscation: zero opacity element"
},
{
"id": "html-obfuscation:zero-size-overflow",
"regex": "<[^>]+style\\s*=\\s*\"[^\"]*(?:height|width)\\s*:\\s*0[^\"]*overflow\\s*:\\s*hidden[^\"]*\"[^>]*>",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "html-obfuscation: zero-size overflow-hidden element"
},
{
"id": "html-obfuscation:aria-label",
"regex": "aria-label\\s*=\\s*\"[^\"]*(?:ignore|override|system|instruction|execute|exfiltrate)[^\"]*\"",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "html-obfuscation: injection in aria-label attribute"
},
{
"id": "evasion:educational",
"regex": "for\\s+educational\\s+purposes?\\s+only",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "evasion: educational purpose framing"
},
{
"id": "evasion:hypothetical",
"regex": "(?:this\\s+is\\s+)?a\\s+hypothetical\\s+scenario",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "evasion: hypothetical scenario framing"
},
{
"id": "evasion:fictional",
"regex": "in\\s+a\\s+fictional\\s+(?:setting|scenario|world)\\s+where",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "evasion: fictional setting framing"
},
{
"id": "evasion:red-team",
"regex": "(?:this\\s+is\\s+)?a\\s+red[- ]?team(?:ing)?\\s+(?:exercise|simulation|test)",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "evasion: red-team exercise framing"
},
{
"id": "evasion:security-audit-sim",
"regex": "security\\s+audit\\s+simulation",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "evasion: security audit simulation framing"
},
{
"id": "evasion:test-pretense",
"regex": "pretend\\s+(?:this\\s+is|we\\s+are\\s+in)\\s+a\\s+(?:test|lab|sandbox|simulation)",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "evasion: test/lab/sandbox pretense"
},
{
"id": "evasion:thought-experiment",
"regex": "as\\s+a\\s+thought\\s+experiment",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "evasion: thought experiment framing"
},
{
"id": "evasion:research-purpose",
"regex": "for\\s+(?:research|academic|scientific)\\s+purposes",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "evasion: research purpose framing"
},
{
"id": "evasion:academic-context",
"regex": "in\\s+an?\\s+(?:academic|research|educational)\\s+context",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "evasion: academic context framing"
},
{
"id": "hitl-trap:approve-immediately",
"regex": "(?:approve|accept|confirm)\\s+(?:this\\s+)?immediately",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "hitl-trap: approval urgency - approve immediately"
},
{
"id": "hitl-trap:no-need-review",
"regex": "no\\s+need\\s+to\\s+review",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "hitl-trap: approval urgency - no need to review"
},
{
"id": "hitl-trap:just-approve",
"regex": "(?:just|simply)\\s+(?:approve|accept|confirm)\\s+(?:it|this|everything)",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "hitl-trap: approval urgency - just approve"
},
{
"id": "hitl-trap:suppress-review",
"regex": "(?:don'?t|do\\s+not)\\s+(?:bother\\s+)?(?:check|review|verify|inspect|read)(?:ing)?\\s+(?:this|the|it)",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "hitl-trap: approval urgency - suppress review"
},
{
"id": "hitl-trap:brevity-skip",
"regex": "for\\s+brevity[\\s,]+(?:skipping|omitting|leaving\\s+out)",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "hitl-trap: summary suppression - for brevity, skipping"
},
{
"id": "hitl-trap:too-long",
"regex": "(?:too\\s+(?:long|verbose|detailed)\\s+to\\s+(?:show|display|list|include))",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "hitl-trap: summary suppression - too long to show"
},
{
"id": "hitl-trap:details-omitted",
"regex": "(?:details?\\s+(?:omitted|redacted|hidden|suppressed))",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "hitl-trap: summary suppression - details omitted"
},
{
"id": "hitl-trap:scope-minimization",
"regex": "(?:minor|trivial|small|cosmetic)\\s+(?:change|update|fix|adjustment)\\b[^.]{0,80}(?:delet|remov|drop|truncat|reset|destroy|\\bformat\\b|wipe)",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "hitl-trap: scope minimization - minor change + destructive action"
},
{
"id": "hybrid-p2sql:inject-sql",
"regex": "(?:ignore|override|disregard|forget)[^.]{0,60}(?:SELECT\\s+\\*|DROP\\s+TABLE|UNION\\s+SELECT|DELETE\\s+FROM|INSERT\\s+INTO|UPDATE\\s+\\w+\\s+SET)(?:\\b|(?=\\s|$))",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "hybrid-p2sql: injection + SQL keywords (prompt-to-SQL attack)"
},
{
"id": "hybrid-p2sql:sql-inject",
"regex": "(?:SELECT\\s+\\*|DROP\\s+TABLE|UNION\\s+SELECT|DELETE\\s+FROM)\\s[^;]{0,80}(?:ignore|override|disregard|bypass)",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "hybrid-p2sql: SQL operation + injection override keywords"
},
{
"id": "hybrid-recursive:inject-output",
"regex": "(?:inject|insert|embed|include)\\s+(?:this|the\\s+following)\\s+(?:into|in)\\s+(?:your|the)\\s+(?:output|response|reply|message|prompt|context)",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "hybrid-recursive: instruction to inject into model output"
},
{
"id": "hybrid-recursive:conditional-response",
"regex": "(?:when|if)\\s+(?:the\\s+)?(?:user|human|operator)\\s+(?:asks?|requests?|queries)[^.]{0,60}(?:respond\\s+with|output|reply\\s+with|include)\\s+(?:this|the\\s+following)",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "hybrid-recursive: conditional response injection (recursive payload)"
},
{
"id": "hybrid-xss:script-tag",
"regex": "<script\\b[^>]*>[\\s\\S]*?</script>",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "hybrid-xss: <script> tag in content (agent context XSS)"
},
{
"id": "hybrid-xss:javascript-uri",
"regex": "javascript\\s*:",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "hybrid-xss: javascript: URI scheme (agent context XSS)"
},
{
"id": "hybrid-xss:event-handler",
"regex": "\\bon(?:error|load|click|mouseover|focus|blur)\\s*=",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "hybrid-xss: inline event handler attribute (agent context XSS)"
},
{
"id": "hybrid-xss:iframe-src",
"regex": "<iframe\\b[^>]*src\\s*=\\s*[\"\\'][^\"\\']*(?:javascript:|data:text/html)",
"flags": "i",
"severity": "high",
"owasp": "LLM01",
"desc": "hybrid-xss: iframe with executable src (agent context XSS)"
},
{
"id": "leetspeak:ignore-previous",
"regex": "[1!|l][gq9]n[o0]r[e3]\\s+(?:all\\s+)?pr[e3]v[i1!|l][o0]us",
"flags": "i",
"severity": "medium",
"owasp": "LLM01",
"desc": "leetspeak: ignore previous (obfuscated)"
},
{
"id": "leetspeak:forget-instructions",
"regex": "f[o0]rg[e3]t\\s+y[o0]ur\\s+[i1!|l]nstruct[i1!|l][o0]ns",
"flags": "i",
"severity": "medium",
"owasp": "LLM01",
"desc": "leetspeak: forget instructions (obfuscated)"
},
{
"id": "leetspeak:disregard",
"regex": "d[i1!|l]sr[e3]g[a4@]rd\\s+y[o0]ur",
"flags": "i",
"severity": "medium",
"owasp": "LLM01",
"desc": "leetspeak: disregard your (obfuscated)"
},
{
"id": "leetspeak:override",
"regex": "[o0]v[e3]rr[i1!|l]d[e3]\\s+y[o0]ur",
"flags": "i",
"severity": "medium",
"owasp": "LLM01",
"desc": "leetspeak: override your (obfuscated)"
},
{
"id": "homoglyph:cyrillic-latin-mix",
"regex": "[a-zA-Z][\u0430\u0435\u043e\u0440\u0441\u0456\u0443]|[\u0430\u0435\u043e\u0440\u0441\u0456\u0443][a-zA-Z]",
"flags": "",
"severity": "medium",
"owasp": "LLM01",
"desc": "homoglyph: Cyrillic-Latin mixing in adjacent characters"
},
{
"id": "unicode:zero-width-in-word",
"regex": "\\w[\u200b\u200c\u200d\ufeff]\\w",
"flags": "",
"severity": "medium",
"owasp": "LLM01",
"desc": "unicode: zero-width character inside word (keyword splitting)"
},
{
"id": "indirect:instruction-to-ai",
"regex": "(?:note|message|instruction)\\s+(?:to|for)\\s+(?:the\\s+)?(?:AI|assistant|model|LLM|Claude)\\b",
"flags": "i",
"severity": "medium",
"owasp": "LLM01",
"desc": "indirect: instruction addressed to AI/assistant"
},
{
"id": "indirect:direct-address",
"regex": "(?:dear|attention)\\s+(?:AI|assistant|model|LLM|Claude)\\b",
"flags": "i",
"severity": "medium",
"owasp": "LLM01",
"desc": "indirect: direct address to AI/assistant"
},
{
"id": "indirect:trigger-based",
"regex": "when\\s+(?:you|the\\s+AI|the\\s+assistant|Claude)\\s+(?:read|see|encounter|process)\\s+this",
"flags": "i",
"severity": "medium",
"owasp": "LLM01",
"desc": "indirect: trigger-based instruction for AI"
},
{
"id": "multi-lang:french",
"regex": "ignor(?:ez?|er?)\\s+(?:les?\\s+)?instructions?\\s+pr[e\u00e9]c[e\u00e9]dentes?",
"flags": "i",
"severity": "medium",
"owasp": "LLM01",
"desc": "multi-lang: French \"ignore previous instructions\""
},
{
"id": "multi-lang:spanish",
"regex": "ignor(?:ar?|e)\\s+(?:las?\\s+)?instrucciones?\\s+anteriores?",
"flags": "i",
"severity": "medium",
"owasp": "LLM01",
"desc": "multi-lang: Spanish \"ignore previous instructions\""
},
{
"id": "multi-lang:german",
"regex": "ignorier(?:e|en)?\\s+(?:alle\\s+)?vorherigen?\\s+(?:Anweisungen|Instruktionen)",
"flags": "i",
"severity": "medium",
"owasp": "LLM01",
"desc": "multi-lang: German \"ignore previous instructions\""
},
{
"id": "markdown:link-ref-comment",
"regex": "\\[//\\]:\\s*#\\s*\\(.*(?:ignore|override|system|instruction|execute)",
"flags": "i",
"severity": "medium",
"owasp": "LLM01",
"desc": "markdown: suspicious instruction in link-reference comment"
},
{
"id": "data-uri:executable",
"regex": "data:(?:text/html|application/javascript|text/javascript)[;,]",
"flags": "i",
"severity": "medium",
"owasp": "LLM01",
"desc": "data-uri: executable content type"
},
{
"id": "markdown:link-anchor-injection",
"regex": "\\[[^\\]]*(?:system|ignore|override|exfiltrate|execute)[^\\]]*\\]\\([^)]+\\)",
"flags": "i",
"severity": "medium",
"owasp": "LLM01",
"desc": "markdown: injection payload in link anchor text"
},
{
"id": "sub-agent:spawn-dangerous",
"regex": "(?:create|spawn|launch|start|run)\\s+(?:an?\\s+)?(?:new\\s+)?(?:sub-?agent|agent|task|worker)\\s+(?:that|to|which|with)\\s+(?:\\S+\\s+){0,12}?(?:execute|run|delete|remove|send|post|exfiltrate|access|reads?\\s+(?:\\S+\\s+){0,12}?(?:secret|credential|key|token|\\.env|\\.ssh))",
"flags": "i",
"severity": "medium",
"owasp": "LLM01",
"desc": "sub-agent: spawn instruction with dangerous capability keywords"
},
{
"id": "sub-agent:delegate-bypass",
"regex": "(?:delegate|dispatch)\\s+(?:to\\s+)?(?:an?\\s+)?(?:new\\s+)?(?:agent|sub-?agent|task)\\s+.{0,120}?(?:bypass|override|ignore|without\\s+(?:review|confirmation|approval))",
"flags": "i",
"severity": "medium",
"owasp": "LLM01",
"desc": "sub-agent: delegation with safety bypass instruction"
},
{
"id": "nl-indirection:fetch-execute",
"regex": "fetch\\s+(?:this|the|that)\\s+(?:URL|link|endpoint)\\s+and\\s+(?:execute|run|eval)",
"flags": "i",
"severity": "medium",
"owasp": "LLM01",
"desc": "nl-indirection: fetch URL and execute"
},
{
"id": "nl-indirection:send-external",
"regex": "send\\s+(?:this|the|that|all)\\s+(?:data|content|output|result|information|file)\\s+to\\s+(?:https?://|ftp://|\\S+@\\S+)",
"flags": "i",
"severity": "medium",
"owasp": "LLM01",
"desc": "nl-indirection: send data to external destination"
},
{
"id": "nl-indirection:read-dotfile",
"regex": "read\\s+(?:the\\s+)?(?:contents?\\s+of\\s+)?(?:~/)?\\.(?:ssh|aws|gnupg|env)\\b",
"flags": "i",
"severity": "medium",
"owasp": "LLM01",
"desc": "nl-indirection: read sensitive dotfile path"
},
{
"id": "nl-indirection:extract-exfiltrate",
"regex": "(?:extract|copy|dump|exfiltrate)\\s+(?:all\\s+)?(?:the\\s+)?(?:credentials?|secrets?|tokens?|keys?|passwords?)\\s+(?:and|then)\\s+(?:send|post|upload|transmit)",
"flags": "i",
"severity": "medium",
"owasp": "LLM01",
"desc": "nl-indirection: extract credentials and exfiltrate"
},
{
"id": "nl-indirection:download-execute",
"regex": "(?:download|fetch|retrieve)\\s+(?:from\\s+)?\\S+\\s+(?:and|then)\\s+(?:execute|run|eval|pipe\\s+to\\s+(?:bash|sh|node|python))",
"flags": "i",
"severity": "medium",
"owasp": "LLM01",
"desc": "nl-indirection: download and execute"
}
]
}
Reference in a new issue View git blame Copy permalink