APEX/BrowserUse_and_ComputerUse_skills
5
0
Fork 0
Code Issues 6 Pull requests 1 Projects 1 Releases Packages Wiki Activity Actions

Merge PR #192: fix(security): catch multi-word prompt injection bypass in skills_guard

Browse source 
Authored by 0xbyt4.

The 'ignore ... instructions' regex only matched a single word between
'ignore' and the keyword (previous/all/above/prior). Multi-word variants
like 'ignore all prior instructions' bypassed the scanner entirely.
This commit is contained in:
teknium1 2026-03-04 05:54:04 -08:00
commit 520a26c48f
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tools/skills_guard.py
View file

@ -157,7 +157,7 @@ THREAT_PATTERNS = [
"markdown link with variable interpolation"),
# ── Prompt injection ──
(r'ignore\s+(previous|all|above|prior)\s+instructions',
(r'ignore\s+(?:\w+\s+)*(previous|all|above|prior)\s+instructions',
"prompt_injection_ignore", "critical", "injection",
"prompt injection: ignore previous instructions"),
(r'you\s+are\s+now\s+',