format_version: 1
name: pipelock-community
version: "2026.07.0"
author: pipelock
description: "Community detection rules for AI agent traffic"
homepage: "https://pipelab.org/rules/pipelock-community"
min_pipelock: "1.4.0"
license: "Apache-2.0"

rules:
  - id: dlp-1password-service-account-token
    type: dlp
    status: stable
    name: "1Password Service Account Token"
    description: "Detects 1Password service account tokens"
    severity: critical
    confidence: high
    references:
      - "https://developer.1password.com/docs/service-accounts/security/"
    tags:
      - "provider:1password"
      - "owasp-llm:LLM06"
    pattern:
      regex: 'ops_[A-Za-z0-9]{20,}'

  - id: dlp-buildkite-user-access-token
    type: dlp
    status: stable
    name: "Buildkite User Access Token"
    description: "Detects Buildkite user API access tokens"
    severity: critical
    confidence: high
    references:
      - "https://buildkite.com/docs/apis/managing-api-tokens"
    tags:
      - "provider:buildkite"
      - "owasp-llm:LLM06"
    pattern:
      regex: 'bkua_[A-Za-z0-9]{20,}'

  - id: dlp-doppler-service-token
    type: dlp
    status: experimental
    name: "Doppler Service Token"
    description: "Detects Doppler service tokens used for secret management"
    severity: critical
    confidence: medium
    references:
      - "https://docs.doppler.com/docs/service-tokens"
    tags:
      - "provider:doppler"
      - "owasp-llm:LLM06"
    pattern:
      regex: 'dp\.[a-z]{2}\.[a-z0-9_-]+\.[A-Za-z0-9_-]{20,}'

  - id: dlp-modal-workspace-key
    type: dlp
    status: experimental
    name: "Modal Workspace Key"
    description: "Detects Modal workspace API keys"
    severity: high
    confidence: medium
    references:
      - "https://modal.com/docs/guide/webhooks"
    tags:
      - "provider:modal"
      - "owasp-llm:LLM06"
    pattern:
      regex: 'wk-[A-Za-z0-9]{16,}'

  - id: dlp-modal-workspace-secret
    type: dlp
    status: experimental
    name: "Modal Workspace Secret"
    description: "Detects Modal workspace API secrets"
    severity: high
    confidence: medium
    references:
      - "https://modal.com/docs/guide/webhooks"
    tags:
      - "provider:modal"
      - "owasp-llm:LLM06"
    pattern:
      regex: 'ws-[A-Za-z0-9]{16,}'

  - id: dlp-perplexity-api-key
    type: dlp
    status: stable
    name: "Perplexity API Key"
    description: "Detects Perplexity AI API keys"
    severity: critical
    confidence: high
    references:
      - "https://docs.perplexity.ai/docs/admin/api-key-management"
    tags:
      - "provider:perplexity"
      - "owasp-llm:LLM06"
    pattern:
      regex: 'pplx-[A-Za-z0-9]{16,}'

  - id: dlp-pulumi-access-token
    type: dlp
    status: stable
    name: "Pulumi Access Token"
    description: "Detects Pulumi personal and team access tokens"
    severity: critical
    confidence: high
    references:
      - "https://www.pulumi.com/blog/scanning-logs-for-secrets/"
    tags:
      - "provider:pulumi"
      - "owasp-llm:LLM06"
    pattern:
      regex: 'pul-[A-Za-z0-9]{20,}'

  - id: dlp-shopify-token-family
    type: dlp
    status: experimental
    name: "Shopify Token Family"
    description: "Detects Shopify access tokens across all token types (admin, partner, custom app, user, storefront)"
    severity: critical
    confidence: medium
    references:
      - "https://community.shopify.dev/t/x-shopify-access-token-format-has-changed/5398"
    tags:
      - "provider:shopify"
      - "owasp-llm:LLM06"
    pattern:
      regex: 'shp(at|pa|ca|ua|ss)_[A-Fa-f0-9]{16,}'

  - id: dlp-vercel-collaboration-token
    type: dlp
    status: stable
    name: "Vercel Collaboration Token"
    description: "Detects Vercel collaboration access tokens"
    severity: critical
    confidence: high
    references:
      - "https://vercel.com/changelog/access-token-prefixes"
    tags:
      - "provider:vercel"
      - "owasp-llm:LLM06"
    pattern:
      regex: 'vck_[A-Za-z0-9._-]{16,}'

  - id: dlp-vercel-integration-token
    type: dlp
    status: stable
    name: "Vercel Integration Token"
    description: "Detects Vercel integration access tokens"
    severity: critical
    confidence: high
    references:
      - "https://vercel.com/changelog/access-token-prefixes"
    tags:
      - "provider:vercel"
      - "owasp-llm:LLM06"
    pattern:
      regex: 'vci_[A-Za-z0-9._-]{16,}'

  - id: dlp-vercel-project-token
    type: dlp
    status: stable
    name: "Vercel Project Token"
    description: "Detects Vercel project-scoped access tokens"
    severity: critical
    confidence: high
    references:
      - "https://vercel.com/changelog/access-token-prefixes"
    tags:
      - "provider:vercel"
      - "owasp-llm:LLM06"
    pattern:
      regex: 'vcp_[A-Za-z0-9._-]{16,}'

  - id: injection-chinese-core-override
    type: injection
    status: experimental
    name: "Chinese Core Override"
    description: "Detects prompt injection override attempts in Chinese"
    severity: high
    confidence: high
    references:
      - "https://arxiv.org/abs/2512.23684"
    tags:
      - "owasp-llm:LLM01"
    pattern:
      regex: '(?:忽略|无视|不要理会)(?:之前|以前|上面|先前)(?:的)?(?:所有)?(?:指示|指令|规则|提示)'

  - id: injection-delimiter-breakout
    type: injection
    status: stable
    name: "Delimiter Breakout"
    description: "Detects fake section delimiters designed to break out of user content boundaries"
    severity: high
    confidence: medium
    references:
      - "https://arxiv.org/abs/2404.13208"
    tags:
      - "owasp-llm:LLM01"
    pattern:
      regex: '(?:-{3,}\s*(?:END|BEGIN|START)\s+(?:OF\s+)?(?:CONTEXT|INSTRUCTIONS?|SYSTEM|PROMPT|RULES)\s*-{3,}|={3,}\s*(?:SYSTEM|ADMIN|OVERRIDE|NEW)\s+(?:MESSAGE|INSTRUCTIONS?|CONTEXT)\s*={3,})'

  - id: injection-explicit-http-exfil
    type: injection
    status: stable
    name: "Explicit HTTP Exfiltration"
    description: "Detects instructions to send sensitive data to external HTTP endpoints"
    severity: critical
    confidence: high
    references:
      - "https://genai.owasp.org/llmrisk/llm01-prompt-injection/"
    tags:
      - "owasp-llm:LLM01"
      - "mitre-atlas:AML.T0048"
    pattern:
      regex: '(?:send|post|forward|upload|transmit|exfiltrate|transfer)\s+(?:the\s+)?(?:api\s+key|credentials?|password|secret|token|conversation|user\s+data|private\s+key|ssh\s+key|environment|config)\s+(?:to|at|via|over)\s+https?://'

  - id: injection-french-core-override
    type: injection
    status: experimental
    name: "French Core Override"
    description: "Detects prompt injection override attempts in French"
    severity: high
    confidence: high
    references:
      - "https://arxiv.org/abs/2512.23684"
    tags:
      - "owasp-llm:LLM01"
    pattern:
      regex: '(?:ignorez|oubliez|abandonnez|rejetez)\s+(?:toutes?\s+)?(?:les\s+)?(?:instructions|r[eè]gles|directives|consignes)\s+(?:pr[eé]c[eé]dentes|ant[eé]rieures|ci-dessus)'

  - id: injection-german-core-override
    type: injection
    status: experimental
    name: "German Core Override"
    description: "Detects prompt injection override attempts in German"
    severity: high
    confidence: high
    references:
      - "https://arxiv.org/abs/2512.23684"
    tags:
      - "owasp-llm:LLM01"
    pattern:
      regex: '(?:ignoriere|vergiss|missachte|verwerfe)\s+(?:alle\s+)?(?:vorherigen|bisherigen|obigen)\s+(?:Anweisungen|Regeln|Vorgaben|Richtlinien)'

  - id: injection-hidden-html-override
    type: injection
    status: stable
    name: "Hidden HTML Override"
    description: "Detects prompt injection hidden in invisible HTML elements"
    severity: high
    confidence: high
    references:
      - "https://genai.owasp.org/llmrisk/llm01-prompt-injection/"
    tags:
      - "owasp-llm:LLM01"
    pattern:
      # Match exact hidden/aria-hidden attributes, including HTML5 unquoted
      # true, without treating class names such as hidden-label as attributes.
      regex: '<(?:div|span|p|input)(?:[^>]*(?:display\s*:\s*none|visibility\s*:\s*hidden)[^>]*|[^>]*aria-hidden\s*=\s*(?:"true"[^>]*|''true''[^>]*|true(?:\s+[^>]*)?)|[^>]*\shidden(?:\s+[^>]*)?)>[^<]{0,500}(?:ignore|disregard|override|forget)\s+(?:all\s+)?(?:previous|prior|system|your)\s+(?:instructions|rules|prompt)'

  - id: injection-html-comment-override
    type: injection
    status: stable
    name: "HTML Comment Override"
    description: "Detects prompt injection hidden inside HTML comments"
    severity: high
    confidence: high
    references:
      - "https://owasp.org/www-community/attacks/PromptInjection"
    tags:
      - "owasp-llm:LLM01"
    pattern:
      regex: '<!--[\s\S]{0,400}(?:ignore|disregard|override|forget)\s+(?:all\s+)?(?:previous|prior|above|system|your)\s+(?:instructions|rules|guidelines|prompt)[\s\S]{0,400}-->'

  - id: injection-spanish-core-override
    type: injection
    status: experimental
    name: "Spanish Core Override"
    description: "Detects prompt injection override attempts in Spanish"
    severity: high
    confidence: high
    references:
      - "https://arxiv.org/abs/2512.23684"
    tags:
      - "owasp-llm:LLM01"
    pattern:
      regex: '(?:ignora|olvida|desecha|descarta)\s+(?:todas?\s+)?(?:las?\s+)?(?:instrucciones|reglas|directivas|restricciones)\s+(?:anteriores|previas|de\s+antes)'

  - id: injection-system-tag-override
    type: injection
    status: stable
    name: "System Tag Override"
    description: "Detects fake system/override XML tags used to impersonate trusted message boundaries"
    severity: high
    confidence: high
    references:
      - "https://arxiv.org/abs/2404.13208"
    tags:
      - "owasp-llm:LLM01"
    pattern:
      # Require suspicious inner text as well as a fake privileged tag. This
      # avoids treating benign admin_message/internal_prompt XML as an attack.
      regex: '<(?:(?:system_instructions?|true_instructions?|real_instructions?|hidden_prompt|system_prompt|secret_instructions?|admin_message|internal_prompt)(?:\s+[^<>]{1,200})?|override)\s*>[^<]{0,300}(?:ignore|discard|forget|reveal|return|follow|bypass|extract|output|proceed|no\s+(?:restrictions|content\s+policy)|privileges\s+granted)'

  - id: injection-tool-call-imperative
    type: injection
    status: stable
    name: "Tool Call Imperative"
    description: "Detects injected instructions commanding direct MCP tool invocations"
    severity: high
    confidence: high
    references:
      - "https://explorer.invariantlabs.ai/docs/mcp-scan/issue-code-reference/"
    tags:
      - "owasp-llm:LLM01"
    pattern:
      regex: '(?:call|invoke|use|execute)\s+(?:the\s+)?tools/(?:call|list|read)\b'

  - id: tool-poison-binary-name-mimicry
    type: tool-poison
    status: experimental
    name: "Binary Name Mimicry"
    description: "Detects MCP tools named after system binaries, which may confuse the model into granting elevated trust"
    severity: high
    confidence: medium
    references:
      - "https://explorer.invariantlabs.ai/docs/mcp-scan/"
    tags:
      - "owasp-llm:LLM01"
    pattern:
      regex: '^(?:bash|sh|zsh|exec|eval|curl|wget|nc|netcat|ssh|scp|cat|rm|mv|cp|chmod|chown|sudo|su|kill|dd|crontab|powershell|cmd)$'
      scan_field: name

  - id: tool-poison-concealment
    type: tool-poison
    status: stable
    name: "Tool Concealment"
    description: "Detects tool descriptions instructing the model to hide actions from the user"
    severity: critical
    confidence: high
    references:
      - "https://explorer.invariantlabs.ai/docs/mcp-scan/issue-code-reference/"
    tags:
      - "owasp-llm:LLM01"
    pattern:
      regex: '(?:do\s+not|don[''’]t|never|must\s+not)\s+(?:tell|inform|notify|reveal|show|mention|display)\s+.{0,40}(?:user|human|operator|caller)'
      scan_field: description

  - id: tool-poison-cross-tool-replacement
    type: tool-poison
    status: stable
    name: "Cross-tool Replacement"
    description: "Detects tool descriptions claiming to replace or override other tools"
    severity: high
    confidence: high
    references:
      - "https://explorer.invariantlabs.ai/docs/mcp-scan/issue-code-reference/"
    tags:
      - "owasp-llm:LLM01"
    pattern:
      regex: '(?:this\s+tool\s+(?:replaces|overrides|supersedes)|ignore\s+(?:any\s+)?other\s+tool|use\s+this\s+(?:instead|in\s+place)\s+of)'
      scan_field: description

  - id: tool-poison-encoded-blob-description
    type: tool-poison
    status: experimental
    name: "Encoded Blob in Description"
    description: "Detects base64-like encoded blobs in tool descriptions followed by execution instructions"
    severity: medium
    confidence: medium
    tags:
      - "owasp-llm:LLM01"
    pattern:
      regex: '[A-Za-z0-9+/]{40,}={0,2}.{0,60}(?:decode|execute|eval|run|follow|process)'
      scan_field: description

  - id: tool-poison-exfil-url-description
    type: tool-poison
    status: stable
    name: "Exfiltration URL in Description"
    description: "Detects tool descriptions instructing the model to send data to external URLs"
    severity: critical
    confidence: high
    references:
      - "https://hiddenlayer.com/innovation-hub/beyond-mcp-expanding-agentic-function-parameter-abuse/"
    tags:
      - "owasp-llm:LLM01"
      - "mitre-atlas:AML.T0048"
    pattern:
      regex: '(?:send|post|forward|upload|submit|transmit|exfiltrate|relay)\s+.{0,60}https?://'
      scan_field: description

  - id: tool-poison-precall-data-harvest
    type: tool-poison
    status: stable
    name: "Pre-call Data Harvest"
    description: "Detects tool descriptions that instruct the model to collect sensitive data before invoking the tool"
    severity: critical
    confidence: high
    references:
      - "https://explorer.invariantlabs.ai/docs/mcp-scan/issue-code-reference/"
    tags:
      - "owasp-llm:LLM01"
    pattern:
      regex: '(?:before\s+(?:(?:calling|using|invoking|running|executing)|you\s+(?:call|use|invoke|run|execute))|prior\s+to\s+(?:calling|using|invoking|running|executing))\s+this\s+(?:tool|function).{0,100}(?:read|collect|gather|retrieve|access|fetch|obtain)\s+.{0,60}(?:env|config|secret|credential|token|key|prompt|ssh|password)'
      scan_field: description

  - id: tool-poison-prompt-harvest
    type: tool-poison
    status: stable
    name: "Prompt Harvest"
    description: "Detects tool descriptions attempting to extract system prompts or internal state"
    severity: critical
    confidence: high
    references:
      - "https://hiddenlayer.com/innovation-hub/beyond-mcp-expanding-agentic-function-parameter-abuse/"
    tags:
      - "owasp-llm:LLM01"
    pattern:
      regex: '(?:system\s+prompt|developer\s+message|chain\s+of\s+thought|hidden\s+instructions?|internal\s+(?:state|context)).{0,60}(?:return|send|export|reveal|collect|extract|include|forward)'
      scan_field: description