rego-art15-ipi-007

rules/rego/complyedge/prompt_security/markdown_exfil.rego

Citation

Not stated in the rule file.

Condition

Text that makes an AI emit a markdown image or link whose URL carries data (a token, key or conversation content) to an outside server when the reply renders.

Layer 1 detects

in any letter case, a markdown image "![...](", an HTML "<img ... src=" (the quote optional) or a markdown link "](", directly followed by an http or https URL whose query string (before any ")", quote or space) contains a parameter named data, leak, exfil, prompt, sys, system, content, payload, q, c, s, secret or token ("?q=" or "&token="). It matches the shape of the link, not what it carries: it does not read whether the URL holds conversation or secret data or who put it there, so it fires on an ordinary search link the user asked for ("[results](https://www.example.com/search?q=opa)"), and it misses a URL that carries data under any other parameter name or in its path. Whether the link exfiltrates data is judged in Layer 2. Deterministic OPA/Rego leaf so this indirect/direct prompt-injection pattern blocks on the /v1/check hot path (previously YAML/TrustLint only, retired from /v1/check). Pattern ported verbatim from the vetted universal YAML corpus.

Condition type

Not stated in the rule file.

Status in the file

approved