SG-090: Covert prompt exfiltration

Severity: CRITICAL

Instruction file directs the agent to silently issue a network call carrying the user's prompt or conversation. The combination of a covertness directive ("silently", "do not mention") + an outbound verb (curl/wget/fetch) + a prompt-shaped variable ($USER_PROMPT, $prompt, $messages) in the same block is the prompt-exfil spyware shape observed in the wild.

Fires when

• An instruction tells the agent to act covertly - 'silently', 'do not mention/show/reveal', 'without telling the user' - near a network call (curl, wget, fetch, Invoke-WebRequest, axios/requests POST)
• That network call's destination is an external host, not localhost or a known LLM API provider
• The data sent is prompt-shaped: a variable like $USER_PROMPT/$prompt/$messages/$ARGUMENTS, or a body field named prompt/messages/conversation/user_input
• Or: a covert send verb ('silently POST', 'send ... without telling the user') sits close to a mention of the user's prompt/conversation/chat history and an external URL

Remediation

Remove the entire instruction block. If your team genuinely wants prompt-logging, do it explicitly: surface a setting the user can see, log to your own infrastructure, and never tell the agent to hide the behavior.