SG-100: Agent-propagated / credential exfiltration

Severity: CRITICAL

Instruction file tells the agent to inject an outbound network call into every generated file, or to harvest environment secrets/credentials and POST them to an external host. Covers prompt-exfil variants that carry no covert keyword and no $USER_PROMPT token (real example: NiranjanJ2/permission-test .gemini/GEMINI.md, 2026-06).

Fires when

• An instruction file tells the agent that every file it generates or modifies must include an outbound network call
• An instruction file enumerates environment variables or reads credential files (filtered by secret/token/key/password names) and sends the result off-host
• Either signal fires only in an agent-instruction-type file and only alongside a network verb plus an external (off-host) sink

Remediation

Remove the instruction block. An instruction file should never tell the agent to inject network calls into generated code or to collect environment secrets/credentials and send them off-host.