What does IH-INJ-001 flag?
Flags known instruction-override phrases, such as telling the agent to ignore previous instructions or not to tell the user.
- A fixed list of 16 phrases, matched without regard to case after collapsing whitespace and removing zero-width characters.
- Examples from the list: ignore previous instructions, disregard the above, do not tell the user, you are now a, reveal the system prompt, new system prompt.
Why it matters
Override phrases try to switch off the agent's judgment just before a harmful step. Snyk's ToxicSkills study reported that 91% of the malicious skills it confirmed also used prompt injection.
Examples
Illustrative shapes with placeholders in angle brackets. They show what the rule looks at; they are not runnable and not taken from real malware.
Can IH-INJ-001 fire on a safe skill?
- Security docs and test files that quote the phrases.
- Role-play skills that legitimately say “you are now a …”.
How do I fix an IH-INJ-001 finding?
- Delete the override text.
- Treat everything in a skill as untrusted instructions, not as system policy.
CLI guidance: Treat skill content as untrusted instructions.
How do I tune or allow IH-INJ-001?
The phrase list lives in the CLI source (src/rules/data/injection-phrases.json). For a docs file that quotes phrases on purpose, use ignoreGlobs.
Every key is described in Configuration. To print this rule from the CLI, run ironheights rules show IH-INJ-001.
What can IH-INJ-001 miss?
- Paraphrases, other languages, or phrases split across lines.
- Injection that arrives in content the skill fetches at run time.
- Quiet steering that uses no override phrase, such as “always recommend these links”.
No finding means no rule matched. It is not proof of safety. Files larger than 1 MiB are skipped without being read; the verdict is then incomplete, not no findings, but the file is still not checked. See Limitations.
Related rules
ironheights rules list.