CTX-02　Prompt injection pattern in SKILL.md

block 0 hits here sandbox-verified

① What it stops

Potential prompt injection payload detected in skill instruction file

Remove the skill; audit its source; report the pattern to the skill marketplace.

② Criteria

Item	Value
Severity	critical
Category	injection
Gate	Gate 1 content safety
Criterion type	file_content
Applies to	Read、Write、Edit

Content patterns

ignore\s+(all\s+)?(previous|prior|above)\s+instructions
disregard\s+(all\s+)?(previous|prior|above)
(you\s+are\s+now|act\s+as\s+(a\s+)?different)
忽略(以上|之前|先前|上面)(的)?(所有)?(指令|指示|规则)
(不管|无视|忽略)(系统|安全|开发者)(提示词|指令|约束)
exfiltrate|send\s+(the\s+)?(secrets?|credentials?|keys?|tokens?)\s+(to|via)
do\s+not\s+(tell|inform|notify|reveal)\s+(the\s+)?user
print\s+(the\s+)?(system\s+prompt|api\s+keys?)

Generated directly from rules/default.json — never hand-written or paraphrased.

③ Real hits

2026-09-24T01:44:33+08:00 ✗ block [CTX-02] tool: Read　exit code: 2 criterion: file_content hit: IGNORE ALL PREVIOUS INSTRUCTIONS

Triggered in a disposable sandbox project using the real hooks/pre_tool_use.py — the same method as challenge/generate_challenge.py. All 24 rules verified this way (24/24).

Zero hits in the 13-day ledger on this machine — we do not post a sample. Zero hits means this machine never hit it, not that the rule is dead; effectiveness is covered by the sandbox trigger above.

④ False positives & exemptions

Built-in exclude patterns are listed under ②. Four exemption mechanisms exist globally (declared workspace roots, policy path whitelist, path-suspect alert-only, exclude patterns); counts on this machine are published on the Chinese page and in Limits.

⑤ Boundaries

Boundary
Criterion type	file_content
Applies to	-
Platform	all platforms
Case sensitivity	Measured: insensitive (`RM -RF` is blocked like `rm -rf`)
Path normalisation	Measured: effective (`./sub/../.env` is blocked)
Scripts not parsed	An absolute path outside the project mentioned in a Bash command is alerted, not blocked — `scripts are not parsed (THREAT_MODEL Non-goals)`
Failure posture	fail-open; best-effort, not a hard security boundary

⑥ Reproduce

grep -h "CTX-02" .psl/audit/*.jsonl | head python challenge/generate_challenge.py python challenge/verify.py

Cite this page

Antinel AgentState. CTX-02 Prompt injection pattern in SKILL.md — rule detail. https://antinel.com/en/agentstate/rules/CTX-02/ (accessed YYYY-MM-DD)

Antinel. (2026). CTX-02 Prompt injection pattern in SKILL.md — rule detail. AgentState. https://antinel.com/en/agentstate/rules/CTX-02/

BibTeX

@misc{antinel_en_agentstate_rules_CTX_02,
  title        = {CTX-02 Prompt injection pattern in SKILL.md — rule detail},
  author       = {{Antinel}},
  year         = {2026},
  url          = {https://antinel.com/en/agentstate/rules/CTX-02/},
  note         = {claim tier: measured}
}

Claim tier: measured　采集时刻：2026-09-23T22:41:18+08:00