artale
/
fable-agent
Template
1
1
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: exclude intentional prompt fixtures from default scan

This commit is contained in:
artale 2026-06-15 12:53:55 +02:00
parent a8fc28f9b4
commit a664863485
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
COMMANDS.md
View File

@ -89,6 +89,7 @@ fable-agent plinius godmode "improve explanation quality"
### `security` ### `security`
- `security scan <target>`: hidden Unicode, reversed tags, fake wrappers, role spoofing, and instruction-smuggling markers - `security scan <target>`: hidden Unicode, reversed tags, fake wrappers, role spoofing, and instruction-smuggling markers
- `--include-fixtures`: include intentional red-team fixtures/generators
### `pai` ### `pai`

6
src/index.ts
View File

@ -2576,7 +2576,8 @@ const security = program
security security
.command("scan <target>") .command("scan <target>")
.description("Scan files for prompt-injection markers") .description("Scan files for prompt-injection markers")
.action(async (target: string) => { .option("--include-fixtures", "Include intentional red-team fixtures/generators")
.action(async (target: string, opts: { includeFixtures?: boolean }) => {
const { findPromptInjection } = await import("./core/prompt-injection-safety.js"); const { findPromptInjection } = await import("./core/prompt-injection-safety.js");
const root = path.resolve(target); const root = path.resolve(target);
const files: string[] = []; const files: string[] = [];
@ -2591,6 +2592,9 @@ security
return; return;
} }
if (/\.(test|spec)\.(ts|js)$/i.test(file)) return; if (/\.(test|spec)\.(ts|js)$/i.test(file)) return;
const rel = path.relative(root, file).replace(/\\/g, "/");
// ponytail: default scan ignores our own intentional prompt-injection generator; use --include-fixtures for audit mode.
if (!opts.includeFixtures && rel === "src/upgrades/parseltongue.ts") return;
if (/\.(md|txt|ts|js|json|yaml|yml)$/i.test(file)) files.push(file); if (/\.(md|txt|ts|js|json|yaml|yml)$/i.test(file)) files.push(file);
}; };