SG-021: Prompt Leaking
Severity: HIGH
Attempts to extract system prompts, tool definitions, MCP server lists, or capability boundaries
Fires when
- Directly asks the AI to print, reveal, or repeat its system prompt or instructions (verbatim, translated, encoded, or via a forced opening phrase)
- Asks the AI to list or reveal its available tools, tool schemas, or MCP servers
- Uses an indirect pretext to extract the prompt - debugging/testing/audit framing, 'repeat after me', sentence completion, or dumping context/conversation as JSON/text
- Probes what files, systems, or permissions the AI can access, or asks what it was told not to reveal
Remediation
No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.