Rule set sha256:274f72f3b49b
rego-art15-ipi-007
One rule of the rule set with digest 274f72f3b49ba2594098351e9f3268903df77a0bd87d5e528f0aa77492d45d25. An audit record that names this digest and this rule was decided by the rule as shown here. Every rule in this set.
| Rule | rego-art15-ipi-007 |
|---|---|
| Rule version | 50e4609ba113a029fa13752e1596741623a8d20800f26d124739c4d7c437ca91 |
| Provision | Regulation (EU) 2024/1689, Article 15(5) ELI: http://data.europa.eu/eli/reg/2024/1689/art_15/par_5/oj |
| Approval | Not approved |
rules/rego/complyedge/prompt_security/markdown_exfil.rego
- Citation
- Not stated in the rule file.
- Condition
- Text that makes an AI emit a markdown image or link whose URL carries data (a token, key or conversation content) to an outside server when the reply renders.
- Layer 1 detects
- in any letter case, a markdown image "![...](", an HTML "<img ... src=" (the quote optional) or a markdown link "](", directly followed by an http or https URL whose query string (before any ")", quote or space) contains a parameter named data, leak, exfil, prompt, sys, system, content, payload, q, c, s, secret or token ("?q=" or "&token="). It matches the shape of the link, not what it carries: it does not read whether the URL holds conversation or secret data or who put it there, so it fires on an ordinary search link the user asked for ("[results](https://www.example.com/search?q=opa)"), and it misses a URL that carries data under any other parameter name or in its path. Whether the link exfiltrates data is judged in Layer 2. Deterministic OPA/Rego leaf so this indirect/direct prompt-injection pattern blocks on the /v1/check hot path (previously YAML/TrustLint only, retired from /v1/check). Pattern ported verbatim from the vetted universal YAML corpus.
- Condition type
- Not stated in the rule file.
- Status in the file
- review