common/hermes
2
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Merge PR #192: fix(security): catch multi-word prompt injection bypass in skills_guard

Browse Source 
Authored by 0xbyt4.

The 'ignore ... instructions' regex only matched a single word between
'ignore' and the keyword (previous/all/above/prior). Multi-word variants
like 'ignore all prior instructions' bypassed the scanner entirely.
This commit is contained in:
teknium1
2026-03-04 05:54:04 -08:00
parent a787a0d60b 4ea29978fc
commit 520a26c48f
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
tools/skills_guard.py
View File

@@ -157,7 +157,7 @@ THREAT_PATTERNS = [
"markdown link with variable interpolation"),
# ── Prompt injection ──
(r'ignore\s+(previous|all|above|prior)\s+instructions',
(r'ignore\s+(?:\w+\s+)*(previous|all|above|prior)\s+instructions',
"prompt_injection_ignore", "critical", "injection",
"prompt injection: ignore previous instructions"),
(r'you\s+are\s+now\s+',