{"rules_version":"pc-1","rules":[{"id":"PC-01","threat_class":"prompt-injection","grade":"observed","title":"Instructions addressed to an AI inside notes","description":"A line that reads like an instruction to an AI reader, not a note to a human: \"ignore/disregard/override/forget previous/prior/earlier/all instructions\", \"system prompt\", \"you are now\", \"as an AI\", \"from now on you\".","patterns":["(ignore|disregard|override|forget).{0,40}(previous|prior|earlier|all).{0,20}instructions?","system prompt","you are now","as an ai","from now on you"]},{"id":"PC-02","threat_class":"memory-poisoning","grade":"observed","title":"Hidden or encoded text","description":"Zero-width characters (U+200B-U+200F, U+2060, U+FEFF), bidirectional override characters (U+202A-U+202E), a base64-shaped run longer than 200 characters, or an HTML comment inside markdown.","patterns":["[\\u200B-\\u200F\\u2060\\uFEFF]","[\\u202A-\\u202E]","[A-Za-z0-9+/]{200,}={0,2}","<!--[\\s\\S]*?-->"]},{"id":"PC-03","threat_class":"social-engineering","grade":"suspected","title":"Urgency language","description":"Words that push toward acting quickly and without verification: immediately, urgent, do not verify, no time to, before anyone, act now, deadline, or else.","patterns":["immediately","urgent","do not verify","no time to","before anyone","act now","deadline","or else"]},{"id":"PC-04","threat_class":"credential-exposure","grade":"observed","title":"Secret-shaped strings","description":"A string shaped like a real credential: a gho_ or ghp_ GitHub token, an sk- key, an AKIA AWS access key id, a -----BEGIN private key header, an xoxb- Slack bot token, a JWT-shaped eyJ... token, or 40+ hex characters following the word \"token\" or \"key\". The excerpt masks all but the first 4 characters of the match.","patterns":["gho_[A-Za-z0-9]{20,}","ghp_[A-Za-z0-9]{20,}","sk-[A-Za-z0-9]{20,}","AKIA[0-9A-Z]{12,}","-----BEGIN[A-Z ]*-----","xoxb-[A-Za-z0-9-]{10,}","eyJ[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}","(?:token|key)\\s*[:=]\\s*[0-9a-fA-F]{40,}"]},{"id":"PC-05","threat_class":"memory-poisoning","grade":"suspected","title":"Unsourced assertion","description":"A line beginning \"Remember:\", \"Note:\", \"Fact:\", \"Update:\" or \"Important:\" that carries no URL, no date and no \"source\" or \"from\" to back the claim.","patterns":[]},{"id":"PC-06","threat_class":"memory-poisoning","grade":"observed","title":"Self-modification order from content","description":"Text inside a file instructing the reader to write to its own memory: \"update (your) HEARTBEAT/MEMORY/SOUL/AGENTS/CLAUDE.md\", \"edit your memory\", \"write this to memory\", \"add to your notes\".","patterns":["update (your )?(HEARTBEAT|MEMORY|SOUL|AGENTS|CLAUDE)\\.md","edit your memory","write this to memory","add to your notes"]},{"id":"PC-07","threat_class":"data-exfiltration","grade":"observed","title":"Instruction to send data to a URL","description":"A send/post/upload/forward instruction naming a key, token, secret, credential, file or memory, aimed \"to\" or \"at\" an http(s) URL.","patterns":["(send|post|upload|forward).{0,60}(key|token|secret|credential|file|memory).{0,40}(to|at) https?://"]},{"id":"PC-08","threat_class":"memory-poisoning","grade":"observed","title":"Curiosity Cat's Danger Map indicators","description":"A literal indicator string, longer than 8 characters, from the Curiosity Cat Danger Map recent-indicators feed. Fetched once per process and cached; if the fetch fails this rule is skipped and reported under rules_skipped, not treated as a finding.","patterns":[]}]}