{"rules_id":"prompt-injection-rules/v1","service":"prompt-injection-verdict","version":"1.0.0","what_is_checked":"Whether one submitted text carries prompt-injection patterns — text written to hijack an agent that reads it. The scan is a deterministic pattern screen: the rules below, applied exactly as published, produce the verdict. No model, no upstream, no stored data.","scope":"This scan is a deterministic pattern screen under the published rulebook (GET /rules). It flags the injection patterns the rulebook covers; a safe verdict means no published pattern matched — it is not a guarantee that a text is safe.","retention":"Submitted text is processed in memory only and is never stored. The payments ledger records only the payer, the time, the price, the verdict, and per-category match counts — never the submitted text.","input_contract":{"format":"JSON POST body: { text: <the text to scan> } (the free pre-check adds caller: <your Solana wallet address>)","caps":{"max_body_bytes":65536,"max_text_chars":8000},"text_measure":"Text length is the JavaScript string length; match positions (start/end) are JavaScript string indices into the submitted text."},"verdict_rule":{"malicious":"at least one matched rule has severity malicious","suspicious":"no malicious match, but at least one matched rule has severity suspicious","safe":"no rule matched in the text or in any normalized view"},"normalization_views":["original — the text exactly as submitted.","leetspeak-folded — the substitutions 0->o, 1->i, 3->e, 4->a, 5->s, 7->t, @->a, $->s applied character for character (offsets unchanged). A folded-view match is reported only when a substitution actually occurred inside its span.","percent-decoded — %XX sequences decoded once, positions mapped back to the submitted text. A decoded-view match is reported only when its span contains a %XX sequence.","base64-decoded — every token of 16+ base64 characters whose decoding is valid UTF-8 text (at least 4 characters, at most 10% control characters) is itself scanned with this same rulebook; a match inside the decoding is reported at the token's span, with the decoded content's rule and severity."],"matching_notes":["All patterns are case-insensitive regular expressions.","Adjacent matches of the same rule merge into one span.","Each (rule, span) pair is reported at most once, however many views produce it."],"sanitization":{"method":"Every flagged span (malicious or suspicious) is replaced with the literal text [removed: <category>]. Overlapping or touching spans merge into a single replacement labelled with the category of the group's highest-severity match (ties broken by longest span, then by rulebook order). A text with no matches is returned byte-identical.","note":"The sanitized copy is a mechanical neutralization under this rulebook, not a rewrite: text around the removed spans is unchanged."},"categories":{"instruction_override":"Commands telling the agent to ignore, discard, or replace its existing instructions.","role_hijack":"Text that impersonates a system/developer role or tries to switch the agent into an unrestricted persona.","delimiter_escape":"Chat-template or context-boundary markers smuggled into untrusted text to fake a new system turn or escape the current context.","exfiltration":"Instructions to send, reveal, or leak the conversation, the system prompt, credentials, or user data to a third party.","tool_coercion":"Fake tool/function-call markup, or instructions to invoke tools without the operator's normal confirmation.","wallet_drain":"Instructions to move funds, sign draining transactions, or hand over seed phrases / private keys.","concealment":"Instructions to hide the text's existence or the agent's actions from the user or operator.","obfuscation":"Invisible characters and other structural tricks used to hide content from a reader or a scanner."},"rules":[{"id":"IO-1","category":"instruction_override","severity":"malicious","description":"A command to ignore, disregard, forget, override, or bypass earlier instructions, prompts, rules, directions, or guidelines.","pattern":"\\b(ignore|disregard|forget|override|bypass)\\b[^.\\n]{0,40}\\b(previous|prior|above|earlier|all|any|the)\\b[^.\\n]{0,24}\\b(instructions?|prompts?|rules?|directions?|guidelines?|messages?)\\b","flags":"i"},{"id":"IO-2","category":"instruction_override","severity":"malicious","description":"A replacement-instruction header: 'new instructions:' or 'here are your new instructions'.","pattern":"\\b(new instructions?\\s*:|here are your new instructions?\\b)","flags":"i"},{"id":"IO-3","category":"instruction_override","severity":"malicious","description":"A statement releasing the agent from its instructions: 'you are no longer bound by', 'stop following', 'cease following', 'no longer follow'.","pattern":"\\b(you are no longer bound by|stop following|cease following|no longer follow)\\b","flags":"i"},{"id":"IO-4","category":"instruction_override","severity":"suspicious","description":"A persistent behaviour directive addressed to the agent: 'from now on, you ...'.","pattern":"\\bfrom now on,?\\s+you\\b","flags":"i"},{"id":"RH-1","category":"role_hijack","severity":"malicious","description":"Fake role markup in the text: <system>, </system>, <developer>, [system], [developer], or <<SYS>> tags.","pattern":"<\\s*\\/?\\s*(system|developer)\\s*>|\\[\\s*(system|developer)\\s*\\]|<<\\s*SYS\\s*>>","flags":"i"},{"id":"RH-2","category":"role_hijack","severity":"suspicious","description":"A bare role label at the start of a line: 'System:', 'Assistant:', or 'Developer:'.","pattern":"(^|\\n)\\s*(system|assistant|developer)\\s*:","flags":"i"},{"id":"RH-3","category":"role_hijack","severity":"malicious","description":"A jailbreak persona switch: 'DAN mode', 'jailbreak mode', 'developer mode enabled/on/active', or 'do anything now'.","pattern":"\\b(DAN mode|jailbreak mode|developer mode (is )?(now )?(enabled|on|active)|do anything now)\\b","flags":"i"},{"id":"RH-4","category":"role_hijack","severity":"malicious","description":"An unrestricted-persona claim or assignment: an 'unrestricted / unfiltered / uncensored mode, assistant, AI or model', or 'act as / pretend / roleplay ... without any restrictions, rules or limits'.","pattern":"\\b(unrestricted|unfiltered|uncensored)\\s+(mode|assistant|ai|model)\\b|\\b(act as|pretend|roleplay)\\b[^.\\n]{0,60}\\bwithout (any )?(restrictions|rules|limits)\\b","flags":"i"},{"id":"DE-1","category":"delimiter_escape","severity":"malicious","description":"A model special-token marker of the form <|...|> (for example <|im_start|>, <|im_end|>, <|endoftext|>).","pattern":"<\\|[^|>\\n]{0,40}\\|>","flags":"i"},{"id":"DE-2","category":"delimiter_escape","severity":"malicious","description":"A chat-template instruction marker: [INST], [/INST], or [SYS].","pattern":"\\[\\/?(INST|SYS)\\]","flags":"i"},{"id":"DE-3","category":"delimiter_escape","severity":"suspicious","description":"Context-boundary prose: 'end of the system prompt / instructions / context', or 'begin a new/fresh context, conversation or session'.","pattern":"\\b(end of (the )?(system )?(prompt|instructions|context)|begin (a )?(new|fresh) (context|conversation|session))\\b","flags":"i"},{"id":"EX-1","category":"exfiltration","severity":"malicious","description":"An instruction to send, post, upload, forward, transmit, email, leak, exfiltrate, reveal, or disclose the conversation (history), chat history, system prompt/message, the agent's instructions, API keys, credentials, passwords, secret/private keys, a seed phrase, or user/personal data.","pattern":"\\b(send|post|upload|forward|transmit|email|leak|exfiltrate|reveal|disclose)\\b[^.\\n]{0,50}\\b(conversation( history)?|chat history|system prompt|system message|your instructions|initial instructions|api keys?|credentials|passwords?|secret keys?|private keys?|seed phrase|user data|personal data)\\b","flags":"i"},{"id":"EX-2","category":"exfiltration","severity":"malicious","description":"An instruction to reveal, print, show, repeat, output, display, recite, or tell the system prompt, system message, initial/hidden/developer instructions, or an API key.","pattern":"\\b(reveal|print|show|repeat|output|display|recite|tell me)\\b[^.\\n]{0,40}\\b(your |the )?(system prompt|system message|initial instructions|hidden instructions|developer instructions|api key)\\b","flags":"i"},{"id":"EX-3","category":"exfiltration","severity":"suspicious","description":"A URL carrying a long encoded-looking value (24+ URL-safe characters) in a query parameter — the shape of data smuggled out inside a link.","pattern":"https?:\\/\\/[^\\s)\"']{8,}?[?&][a-z_]{1,12}=[A-Za-z0-9+/=_-]{24,}","flags":"i"},{"id":"TC-1","category":"tool_coercion","severity":"malicious","description":"Fake tool-call markup in the text: <function_calls>, <function_call>, <invoke>, or <tool_call> tags.","pattern":"<\\s*(function_calls|function_call|invoke|tool_call)\\b","flags":"i"},{"id":"TC-2","category":"tool_coercion","severity":"malicious","description":"An instruction to call, invoke, run, execute, or use a function/tool without (or before) asking, confirmation, permission, approval, or telling.","pattern":"\\b(call|invoke|run|execute|use)\\b[^.\\n]{0,30}\\b(function|tool)\\b[^.\\n]{0,50}\\b(without|before)\\b[^.\\n]{0,24}\\b(asking|confirm|confirmation|permission|approval|telling)\\b","flags":"i"},{"id":"TC-3","category":"tool_coercion","severity":"suspicious","description":"An instruction to run or execute 'this' or 'the following' command, script, shell, or code.","pattern":"\\b(run|execute)\\s+(this|the following)\\s+(command|script|shell|code)\\b","flags":"i"},{"id":"WD-1","category":"wallet_drain","severity":"malicious","description":"An instruction to transfer, send, move, drain, withdraw, or sweep funds, a balance, tokens, assets, SOL, USDC, or crypto to a destination.","pattern":"\\b(transfer|send|move|drain|withdraw|sweep)\\b[^.\\n]{0,40}\\b(all|the|my|your|his|her|their)?\\s*(funds|balance|tokens?|assets|sol|usdc|crypto(currency)?)\\b[^.\\n]{0,40}\\bto\\b","flags":"i"},{"id":"WD-2","category":"wallet_drain","severity":"malicious","description":"A request to enter, type, provide, share, give, input, or paste a seed phrase, private key, recovery phrase, or mnemonic.","pattern":"\\b(enter|type|provide|share|give|input|paste)\\b[^.\\n]{0,30}\\b(seed phrase|private key|recovery phrase|mnemonic)\\b","flags":"i"},{"id":"WD-3","category":"wallet_drain","severity":"malicious","description":"A seed phrase, private key, recovery phrase, or mnemonic named together with a demand to enter, type, provide, share, give, input, or paste it (or 'here' / 'below').","pattern":"\\b(seed phrase|private key|recovery phrase|mnemonic)\\b[^.\\n]{0,30}\\b(enter|type|provide|share|give|input|paste|here|below)\\b","flags":"i"},{"id":"WD-4","category":"wallet_drain","severity":"suspicious","description":"An instruction to 'sign this/the/a transaction'.","pattern":"\\bsign (this|the|a) transaction\\b","flags":"i"},{"id":"CC-1","category":"concealment","severity":"malicious","description":"An instruction not to tell, inform, notify, or alert the user, human, operator, owner, or anyone ('do not / don't / never tell ...').","pattern":"\\b(do not|don't|never)\\s+(tell|inform|notify|alert)\\b[^.\\n]{0,24}\\b(the )?(user|human|operator|owner|anyone)\\b","flags":"i"},{"id":"CC-2","category":"concealment","severity":"suspicious","description":"'Keep this secret / hidden / confidential from ...'.","pattern":"\\bkeep this (secret|hidden|confidential) from\\b","flags":"i"},{"id":"CC-3","category":"concealment","severity":"suspicious","description":"Output forcing: 'respond only with ...'.","pattern":"\\brespond only with\\b","flags":"i"},{"id":"CC-4","category":"concealment","severity":"suspicious","description":"'Never mention these/this/your/the instructions, prompt, or rules'.","pattern":"\\bnever mention (these|this|your|the) (instructions?|prompt|rules)\\b","flags":"i"},{"id":"OB-1","category":"obfuscation","severity":"suspicious","description":"Invisible characters embedded in the text: zero-width space/joiners (U+200B-U+200D), word joiner (U+2060), byte-order mark (U+FEFF), or Mongolian vowel separator (U+180E). Adjacent matches of this rule merge into one span.","pattern":"[\\u200B-\\u200D\\u2060\\uFEFF\\u180E]","flags":"i"}],"prices":{"precheck":"free — verdict line only, 100/day per caller wallet, rate-limited (minimum interval between free pre-checks)","scan":{"usd":0.01,"includes":"$0.01 buys one prompt-injection scan of one submitted text — verdict, matched patterns, and a sanitized copy. Submitted text is processed in memory only and is never stored. The payments ledger records only the payer, the time, the price, the verdict, and per-category match counts — never the submitted text. This scan is a deterministic pattern screen under the published rulebook (GET /rules). It flags the injection patterns the rulebook covers; a safe verdict means no published pattern matched — it is not a guarantee that a text is safe."}}}