Repository navigation
P2 "Hidden Instructions" rule produces false positives due to missing word boundary on GET #297
Description
Issue
The P2 pattern in static_patterns_prompt_injection.py (line 52) matches GET case-insensitively without a word boundary:
(r"<!--.*?(?:system|instructions?|ignore|POST|GET|send|transmit).*?-->", 0.7),Result
This causes false positives in two scenarios:
1. Substring match — common words containing "get"
For example any HTML comment containing the word target will trigger the rule because the regex matches the substring get inside target.
Example:
<!-- Minimum touch target size for button controls -->This fires at 70% confidence despite no malicious intent.
2. Multi-comment spanning
The regex can span across multiple HTML comments, treating everything between the first <!-- and a distant --> as a single match. This means it picks up get from completely unrelated code like document.getElementById(...) in between.
Example:
<!-- Section header -->
<button id="openBtn">Open</button>
<script>
document.getElementById("openBtn").addEventListener("click", handler);
</script>
<!-- End of section -->The entire block is flagged as a single match.
Suggested fix:
Add \b word boundaries:
(r"<!--.*?(?:\bsystem\b|\binstructions?\b|\bignore\b|\bPOST\b|\bGET\b|\bsend\b|\btransmit\b).*?-->", 0.7),
Activity
jayanth922 commentedon Jul 23, 2026
I would like to take this issue
rng1995 commentedon Sep 16, 2026
Implementation is in progress in PR #452, which adds proper keyword boundaries (including
GETTINGcontrols) and confines P2 matches to one HTML comment. Keeping this issue open until the PR merges and the reported false-positive reproduction passes.Baseline SkillSpector P2: it reads 'together' as 'get' in a template …
rng1995 commentedon Oct 4, 2026
PR-state snapshot checked on 2026-10-04:
Keeping this issue open: the relevant implementation is not merged. Check/review status is a point-in-time snapshot, not a claim of merge readiness.