+
    lHàjx)  ã                  óF  a € 0 t $ R t^ RIHt ^ RIt^ RIt^ RIHtHtH	t	 Rt
RtRtRt. R] R	] R
2RR3NRDNR] R] R2RR3NR] R] R] R2RR3NRENRFNRGNR] R] R2RR3NR] R2RR3NR] R2R R3NR!] R"2R#R3NR$] R%2R&R3NR'] R(2R)R3NRHNRINRJNRKNRLNRMNRNNR*] R+] R,] R-2R.R3NRONRPNRQNRRNR/] 2R0R3NR1] 2R2R3NRSNRTNR4] R52R6R33NRUNRVNRWN] R72R8R33N] R92R:R33NRXNtR;]R<&   ]! R=4      tRRYRRZR3R[/tR> R? lt]! 4       tR\R@ RA lltR[RB RC llt. R]OtR# )^aÌ  Shared threat-pattern library (prompt injection / promptware / exfiltration) for
``agent/prompt_builder.py``, ``tools/memory_tool.py`` and ``agent/tool_dispatch_helpers.py``.
Each pattern is ``(regex, pattern_id, scope)``; scope is cumulative: ``"all"`` everywhere,
``"context"`` adds promptware / C2 / role hijack for context files, memory and tool results
(warn-level: that content is not user-authored), ``"strict"`` adds aggressive checks only for
user-mediated writes (memory, skill installs) where a block is resolvable. New patterns must
anchor on C2 vocabulary or unambiguous attack behavior, NOT bossy English ("you must" is common
in legitimate AGENTS.md); filler between tokens is the bounded ``_FILLER``.)ÚannotationsN)ÚListÚOptionalÚTuplei   z(?:\w+\s+){0,8}z4\$\{?\w*(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)S?\bzA(update|modify|edit|write|change|append|add\s+to)\s+[^\n]{0,2048}z	ignore\s+z(previous|all|above|prior)\s+ÚinstructionsÚprompt_injectionÚallzdisregard\s+z(your|all|any)\s+z(instructions|rules|guidelines)Údisregard_ruleszact\s+as\s+(if|though)\s+zyou\s+z(have\s+no|don\'t\s+have)\s+z(restrictions|limits|rules)Úbypass_restrictionszdo\s+not\s+ztell\s+z
the\s+userÚdeception_hidezyou\s+are\s+znow\s+(?:a|an|the)\s+Úrole_hijackÚcontextz
pretend\s+z(you\s+are|to\s+be)\s+Úrole_pretendz	output\s+z(system|initial)\s+promptÚleak_system_promptz#(respond|answer|reply)\s+without\s+z)(restrictions|limitations|filters|safety)Úremove_filterszyou\s+have\s+been\s+z(updated|upgraded|patched)\s+toÚfake_updateznever\s+z(?:create|write)\s+z(?:script|file)\s+ÚdiskÚanti_forensic_diskzcurl\s+[^\n]{0,2048}Ú
exfil_curlzwget\s+[^\n]{0,2048}Ú
exfil_wgetÚstrictz(include|output|print|share)\s+zQ(conversation|chat\s+history|previous\s+messages|full\s+context|entire\s+context)Úcontext_exfilz4(?:AGENTS\.md|CLAUDE\.md|\.cursorrules|\.clinerules)Úagent_config_modz \.hermes/(config\.yaml|SOUL\.md)Úhermes_config_modzlist[tuple[str, str, str]]Ú	_PATTERNSu3   â€‹â€Œâ€�â� â�¢â�£â�¤ï»¿â€ªâ€«â€¬â€­â€®â�¦â�§â�¨â�©c               ó   € V ^8„  d   QhRR/# )é   Úreturnz'dict[str, list[tuple[re.Pattern, str]]]© )Úformats   "Ú:/home/ubuntu/.hermes/hermes-agent/tools/threat_patterns.pyÚ__annotate__r!   v   s   € ÷ ñ Ð9ñ ó    c                 ó  € R . R. R. /p \          Ft  w  rpV\        9  d   \        RV: RV: 24      h\        V,           F?  pW,          P                  \        P
                  ! V\        P                  4      V34       KA  	  Kv  	  V # )r   r   r   zthreat_patterns: unknown scope z for pattern )r   Ú_SCOPE_SETSÚ
ValueErrorÚappendÚreÚcompileÚ
IGNORECASE)ÚcompiledÚpatternÚpidÚscopeÚss        r    Ú_compiler/   v   s…   € Ø9>ÀÀIÈrÐS[Ð]_Ð8`€Hß(Ñˆ�eØœÔ#ÜÐ>¸u¹iÀ}ÐUXÑT[Ð\Ó]Ð]Ü˜U×#Ð#ˆAØ�K×Ñ¤§
¢
¨7´B·M±MÓ BÀCÐHÖIó $ñ  )ð
 €Or"   c               ó$   € V ^8„  d   QhRRRRRR/# )r   ÚcontentÚstrr-   r   z	list[str]r   )r   s   "r    r!   r!   ƒ   s!   € ÷ ñ ˜cð ¨#ð ¸iñ r"   c                óP  a€ V '       g   . # \         P                  V4      ;pf   \        RV: 24      hV R\         p \	        V 4      \
        ,           Uu. uF  pR\        V4      R 2NK  	  pp\        P                  ! RV 4      oVP                  V3R lV 4       4       V# u upi )z�Matched pattern IDs in ``content`` for ``scope``; invisible codepoints are
reported as ``"invisible_unicode_U+XXXX"``. Raises ValueError on an unknown scope.Nz scan_for_threats: unknown scope zinvisible_unicode_U+Ú04XÚNFKCc              3  ó^   <"  € T F"  w  rVP                  S4      '       g   K  Vx € K$  	  R # 5i)N)Úsearch)Ú.0r*   r,   Ú
normaliseds   &  €r    Ú	<genexpr>Ú#scan_for_threats.<locals>.<genexpr>�   s    øé € ÐU©X™M˜H¸¿¹È×9T—C’C«Xùs   ƒ-£
-)
Ú	_COMPILEDÚgetr%   ÚMAX_SCAN_CHARSÚsetÚINVISIBLE_CHARSÚordÚunicodedataÚ	normalizeÚextend)r1   r-   ÚpatternsÚchÚfindingsr9   s   &&   @r    Úscan_for_threatsrH   ƒ   sŸ   ø€ ÷ Øˆ	Ü—M‘M %Ó(Ð(ˆÒ1ÜÐ;¸E¹9ÐEÓFÐFØ�o”~Ð&€GäJMÈgË,ÔYhÖJhÓiÑJhÀBÐ1´#°b³'¸#°Ó?ÑJh€HÐiô ×&Ò& v¨wÓ7€JØ‡O�OÔU©XÓUÔUØ€Oùò js   ÁB#c               ó$   € V ^8„  d   QhRRRRRR/# )r   r1   r2   r-   r   zOptional[str]r   )r   s   "r    r!   r!   ”   s!   € ÷ 4ñ 4 #ð 4¨cð 4Àñ 4r"   c                óª   € \        WR7      pV'       g   R# V^ ,          pVP                  R4      '       d   VP                  RR4      pRV R2# RV R2# )	zQUser-facing error for the first threat found, or None (block-on-first-hit paths).)r-   NÚinvisible_unicode_Ú z6Blocked: content contains invisible unicode character z (possible injection).z)Blocked: content matches threat pattern 'zf'. Content is injected into the system prompt and must not contain injection or exfiltration payloads.)rH   Ú
startswithÚreplace)r1   r-   rG   r,   Ú	codepoints   &&   r    Úfirst_threat_messagerP   ”   sb   € ä Ô5€HßÙØ
�1�+€CØ
‡~�~Ð*×+Ò+Ø—K‘KÐ 4°bÓ9ˆ	ØGÈ	À{ÐRhÐiÐiØ7¸°uð =2ð 3ð 4r"   )zsystem\s+prompt\s+overrideÚsys_prompt_overrider   )zE<!--[^>]{0,512}(?:ignore|override|system|secret|hidden)[^>]{0,512}-->Úhtml_comment_injectionr   )z9<\s*div\s+style\s*=\s*["\'][^>]{0,2048}display\s*:\s*noneÚ
hidden_divr   )zTtranslate\s+[^\n]{0,512}\s+into\s+\w+(?:[\s-]+\w+){0,2}\s+and\s+(execute|run|eval)\bÚtranslate_executer   )z\bname\s+yourself\s+\w+Úidentity_overrider   )zregister\s+(as\s+)?a?\s*nodeÚc2_node_registrationr   )z0(heartbeat|beacon|check[\s\-]?in)\s+(to|with)\s+Úc2_heartbeatr   )z,pull\s+(down\s+)?(?:new\s+)?task(?:ing|s)?\bÚc2_task_pullr   )zconnect\s+to\s+the\s+network\bÚc2_network_connectr   )z>you\s+must\s+(?:\w+\s+){0,3}(register|connect|report|beacon)\bÚforced_actionr   )z only\s+use\s+one[\s\-]?liners?\bÚanti_forensic_onelinerr   )z<unset\s+\w*(?:CLAUDE|CODEX|HERMES|AGENT|OPENAI|ANTHROPIC)\w*Úenv_var_unset_agentr   )z@\b(?:cobalt\s*strike|sliver|havoc|mythic|metasploit|brainworm)\bÚknown_c2_frameworkr   )z1\bc2\s+(?:server|channel|infrastructure|beacon)\bÚc2_explicitr   )z\bcommand\s+and\s+control\bÚc2_explicit_longr   )zHcat\s+[^\n]{0,2048}(\.env|credentials|\.netrc|\.pgpass|\.npmrc|\.pypirc)Úread_secretsr   )zA(send|post|upload|transmit)\s+[^\n]{0,2048}\s+(to|at)\s+https?://Úsend_to_urlr   )Úauthorized_keysÚssh_backdoorr   )z²(?:\b(?:echo|cat|cp|mv|dd|tee|install|printf|rsync|scp|ln|append|add|write|sed|chmod|chown|truncate|rm|touch|curl|wget|git)\b|\bopen\s*\(|>>?)[^\n]{0,512}(?:\$HOME/\.ssh|~/\.ssh)Ú
ssh_accessr   )z'\$HOME/\.hermes/\.env|\~/\.hermes/\.envÚ
hermes_envr   )zu(?:api[_-]?key|token|secret|password)\s*[=:]\s*["\'](?!(?-i:[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+)["\'])[A-Za-z0-9+/=_-]{20,}Úhardcoded_secretr   )r   r   r   )r   r   )r   )r   )r@   r>   rP   rH   )Ú__conditional_annotations__Ú__doc__Ú
__future__r   r'   rB   Útypingr   r   r   r>   Ú_FILLERÚ_SECRET_VARÚ_MODIFYr   Ú__annotations__Ú	frozensetr@   r$   r/   r<   rH   rP   Ú__all__)rg   s   @r    Ú<module>rq      s   øðôOõ #ã 	Û ß (Ñ (ð €à
€àE€à
N€ðP)à�'�Ð7¸°yÀÐMÐOaÐchÐiðP)ð BðP)ð 	�W�IÐ.¨w¨iÐ7VÐWÐYjÐlqÐrð	P)ð
 	" ' ¨&°°	Ð9UÐV]ÐU^Ð^yÐzð  }Rð  TYð  ZðP)ð pðP)ð XðP)ððP)ð 	�G�9˜G G 9¨JÐ7Ð9IÈ5ÐQðP)ð  	�W�IÐ2Ð3°]ÀIÐNð!P)ð" 	�7�)Ð1Ð2°NÀIÐNð#P)ð$ 	�'�Ð3Ð4Ð6JÈIÐVð%P)ð& 	,¨G¨9Ð4]Ð^Ð`pÐr{Ð|ð'P)ð( 	˜W˜IÐ%DÐEÀ}ÐV_Ð`ð)P)ð, Að-P)ð6 Ið7P)ð8 Uð9P)ð: Qð;P)ð< Ið=P)ð@ dðAP)ðD OðEP)ðF 	��	Ð,¨W¨IÐ5GÈÀyÐPTÐUÐWkÐmvÐwðGP)ðJ hðKP)ðT kðUP)ðV UðWP)ðX DðYP)ðd 	˜{˜mÐ,¨l¸EÐBðeP)ðf 	˜{˜mÐ,¨l¸EÐBðgP)ðh iðiP)ðj dðkP)ðl 	(¨ yð  1Bð  Cð  ETð  V^ð  _ðmP)ðr 3ðsP)ð|Fð}P)ðB IðCP)ðD 
ˆ	ÐEÐFÐHZÐ\dÐeðEP)ðF 
ˆ	Ð1Ð2Ð4GÈÐRðGP)ðZ=ð[P)€	Ð%ó Pñj ð=ó>€ð
 Ð2°IÐ?TÐV^Ð`kÐl€õñ ‹J€	÷÷"4ò \‚r"   