Prompt Injection Patterns

Variations: These often use synonyms (skip, bypass, replace, overwrite) or add filler text between keywords to avoid detection.

Jailbreak Patterns

Attempts to remove the agent’s safety constraints:

Role Reassignment

Attempts to change the agent’s identity or role:

System Prompt Extraction

Attempts to exfiltrate the agent’s system prompt:

Obfuscation Techniques

Methods used to hide injection patterns from detection:

Base64 Encoding

Instructions encoded in base64 that, when decoded, contain injection patterns. Example: a skill that includes aWdub3JlIGFsbCBwcmV2aW91cyBpbnN0cnVjdGlvbnM= which decodes to “ignore all previous instructions”.

Zero-Width Characters

Unicode characters that are invisible but present in text:

• U+200B Zero-width space
• U+200C Zero-width non-joiner
• U+200D Zero-width joiner
• U+2060 Word joiner
• U+FEFF Zero-width no-break space

These can be used to split keywords to evade pattern matching (e.g., “ig​nore” with a zero-width space).

Homoglyph Characters

Characters that look identical to ASCII but are from different Unicode blocks:

• Cyrillic а (U+0430) vs Latin a (U+0061)
• Greek ο (U+03BF) vs Latin o (U+006F)

Used to make malicious instructions look like normal text while bypassing keyword filters.

RTL Override

Unicode bidirectional override characters (U+202E) can reverse displayed text direction, hiding the true content from visual review.

Unicode Tag Characters (U+E0000 block)

The Tags Unicode block (U+E0001–U+E007F) provides invisible representations of every ASCII character. These are:

• Invisible in all text editors, GitHub, and terminal output
• Processed normally by LLM tokenizers
• Mapping: ASCII code point + 0xE0000 = invisible tag character

Detection: cat -v shows escape sequences, or check file size vs visible content (large discrepancy = suspicious). The scanner decodes these automatically.

PNG/Image Metadata Injection

Hidden instructions embedded in PNG metadata chunks (tEXt, iTXt, Description, Comment fields). The image renders normally but metadata contains prompt injection text. Multimodal LLMs that inspect image files can read and follow these instructions.

Detection: exiftool <image> or check for tEXt/iTXt chunks in PNG binary data.

Whitespace and Formatting

• Injection patterns hidden in trailing whitespace
• Instructions placed in markdown that renders as invisible (e.g., empty links, reference-style links that aren’t displayed)

Hidden Content Vectors

HTML Comments

HTML comments are not rendered but may be processed by the agent.

Markdown Reference Links

Markdown comments using reference link syntax.

Invisible Markdown

• Empty links: [](https://evil.com/exfil?data=...)
• Images that don’t render but may be fetched: ![](https://evil.com/track)

Indirect Injection

Instructions in Example Output

A skill that claims to format output but embeds injection in its example:

Self-Referential Instructions

Instructions that tell the agent to modify its own behavior for future interactions:

• “Add the following to your memory…”
• “Remember this for all future conversations…”
• “Update your CLAUDE.md with…”

False Positive Guide

Security skills are not malicious for discussing injection patterns.

When evaluating findings, distinguish between:

Key question: Does this pattern exist to attack the agent, or to inform about attacks?

• Patterns in references/ files are almost always documentation
• Patterns in SKILL.md instructions that target the agent running the skill are attacks
• Patterns in code being scanned/analyzed are the skill’s subject matter
• Patterns hidden via obfuscation are almost always attacks regardless of context