[DRAFT — DO NOT MERGE pending rf-i17] feat(experimental): prompt-injection detector (rf-bmo)#82
Draft
Rome-1 wants to merge 1 commit into
Draft
[DRAFT — DO NOT MERGE pending rf-i17] feat(experimental): prompt-injection detector (rf-bmo)#82Rome-1 wants to merge 1 commit into
Rome-1 wants to merge 1 commit into
Conversation
Pattern-based PromptInjectionDetector with parity in Node and Python.
Hidden behind experimental flags pending APPROVE bead rf-i17 — do not
merge to main.
Surfaces:
- rafter scan injection <path> (hidden subcommand) for spot checks
- rafter hook posttool --experimental-prompt-injection flags injection
markers in tool responses to stderr (does NOT modify the response)
Detector covers role-override phrases, tool/exfil patterns, hidden
Unicode (tag chars / bidi / zero-width-in-word), HTML/markdown comment
imperatives, and base64-decoded payload re-scan. Returns score 0-100
and verdict ∈ {clean,suspicious,likely_injection}.
Documented threat model, prior-art survey, FP/FN tradeoffs, and known
bypasses in docs/research/prompt-injection-detector.md. Tests include
positive corpus, clean-baseline guards, and explicit known-bypass
fixtures so future improvements have a target.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This was referenced May 17, 2026
Rome-1
added a commit
that referenced
this pull request
May 18, 2026
…n parity, hidden behind --experimental flag (#118) Pattern-based PromptInjectionDetector with parity in Node and Python. Hidden behind experimental flags pending APPROVE bead rf-i17 — do not merge to main. Consolidated from drafts PR #60 (feat/prompt-injection-detector) and PR #82 (polecat/granite-mokqoiob); both PRs point at the same head commit, so baseline #82 was used and #60 contained no additional content. Surfaces: - rafter scan injection <path> (hidden subcommand) for spot checks - rafter hook posttool --experimental-prompt-injection flags injection markers in tool responses to stderr (does NOT modify the response) Detector categories: role-override (jailbreak phrases, "ignore previous instructions", DAN, role-confusion), tool/exfil (remote-pipe-shell, "send api keys to ...", "delete all files"), hidden Unicode (tag chars U+E0000–U+E007F, bidi override, zero-width-in-word), HTML/markdown comment imperatives, and base64-decoded payload re-scan (indirect/RAG-fetch injection). Output: structured finding with category (pattern name), severity (low|medium|high|critical → confidence), evidence and remediation hint; aggregate score 0-100 and verdict ∈ {clean,suspicious,likely_injection}. Default behavior: warn only (stderr). Block behavior requires explicit opt-in via .rafter.yml; no default surface changes for non-opted users. Documented threat model, prior-art survey, FP/FN tradeoffs, and known bypasses in docs/research/prompt-injection-detector.md. Tests include positive corpus, clean-baseline guards, and explicit known-bypass fixtures so future improvements have a target. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
⚠ DRAFT — DO NOT MERGE
Pending APPROVE bead rf-i17. Hidden behind experimental flags. Opened as part of porting MQ wisp
rc-wisp-9s0to a reviewable PR (no refinery running).Summary
Pattern-based PromptInjectionDetector with parity in Node and Python. Hidden behind
--experimental-prompt-injectionflag.Surfaces:
rafter scan injection <path>(hidden subcommand) for spot checksrafter hook posttool --experimental-prompt-injectionflags injection markers in tool responses to stderr (does NOT modify the response)Detector covers: role-override phrases, tool/exfil patterns, hidden Unicode (tag chars / bidi / zero-width-in-word), HTML/markdown comment imperatives, and base64-decoded payload re-scan. Returns score 0-100 and verdict ∈ {clean, suspicious, likely_injection}.
Documented threat model, prior-art survey, FP/FN tradeoffs, and known bypasses in
docs/research/prompt-injection-detector.md.Test plan
🤖 Generated with Claude Code