Findings & checks · 22 flagged
HIGH"Ignore previous instructions" command embedded in the skillSS-SKILL-INJECT-IGNORE-01 · Prompt injection · docs/INTEGRATION_GUIDE.md
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
- Delete the
ignore/disregard/forget … previous instructionssentence. - If this is jailbreak-research or tutorial content, move the example into a clearly fenced, non-instruction block and label it as a quoted sample.
Trace & refs
HIGH"Ignore previous instructions" command embedded in the skillSS-SKILL-INJECT-IGNORE-01 · Prompt injection · docs/internal/agent-commerce-threat-model.md
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
- Delete the
ignore/disregard/forget … previous instructionssentence. - If this is jailbreak-research or tutorial content, move the example into a clearly fenced, non-instruction block and label it as a quoted sample.
Trace & refs
HIGH"Ignore previous instructions" command embedded in the skillSS-SKILL-INJECT-IGNORE-01 · Prompt injection · paper-artifacts/diversity-audit/results.json
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
- Delete the
ignore/disregard/forget … previous instructionssentence. - If this is jailbreak-research or tutorial content, move the example into a clearly fenced, non-instruction block and label it as a quoted sample.
Trace & refs
HIGH"Ignore previous instructions" command embedded in the skillSS-SKILL-INJECT-IGNORE-01 · Prompt injection · paper-artifacts/extensions/hard-negatives/cat-g-page-vocab.json×2
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
Show all 2 locations
- Delete the
ignore/disregard/forget … previous instructionssentence. - If this is jailbreak-research or tutorial content, move the example into a clearly fenced, non-instruction block and label it as a quoted sample.
Trace & refs
HIGH"Ignore previous instructions" command embedded in the skillSS-SKILL-INJECT-IGNORE-01 · Prompt injection · paper-artifacts/seed-templates/cat-A.md
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
- Delete the
ignore/disregard/forget … previous instructionssentence. - If this is jailbreak-research or tutorial content, move the example into a clearly fenced, non-instruction block and label it as a quoted sample.
Trace & refs
HIGH"Ignore previous instructions" command embedded in the skillSS-SKILL-INJECT-IGNORE-01 · Prompt injection · paper-artifacts/seed-templates/cat-D.md×2
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
Show all 2 locations
- Delete the
ignore/disregard/forget … previous instructionssentence. - If this is jailbreak-research or tutorial content, move the example into a clearly fenced, non-instruction block and label it as a quoted sample.
Trace & refs
HIGH"Ignore previous instructions" command embedded in the skillSS-SKILL-INJECT-IGNORE-01 · Prompt injection · paper-artifacts/seed-templates/cat-G.md
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
- Delete the
ignore/disregard/forget … previous instructionssentence. - If this is jailbreak-research or tutorial content, move the example into a clearly fenced, non-instruction block and label it as a quoted sample.
Trace & refs
HIGH"Ignore previous instructions" command embedded in the skillSS-SKILL-INJECT-IGNORE-01 · Prompt injection · tests/redteam/corpus/attacks-flash-gpt-never-at-k5-195.json×2
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
Show all 2 locations
- Delete the
ignore/disregard/forget … previous instructionssentence. - If this is jailbreak-research or tutorial content, move the example into a clearly fenced, non-instruction block and label it as a quoted sample.
Trace & refs
HIGH"Ignore previous instructions" command embedded in the skillSS-SKILL-INJECT-IGNORE-01 · Prompt injection · tests/redteam/corpus/attacks-opus-rerun-312.json×5
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
Show all 5 locations
- Delete the
ignore/disregard/forget … previous instructionssentence. - If this is jailbreak-research or tutorial content, move the example into a clearly fenced, non-instruction block and label it as a quoted sample.
Trace & refs
HIGH"Ignore previous instructions" command embedded in the skillSS-SKILL-INJECT-IGNORE-01 · Prompt injection · tests/redteam/corpus/attacks.json×5
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
Show all 5 locations
- Delete the
ignore/disregard/forget … previous instructionssentence. - If this is jailbreak-research or tutorial content, move the example into a clearly fenced, non-instruction block and label it as a quoted sample.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · docs/INTEGRATION_GUIDE.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<p align="center"> <picture> <img src="https://raw.githubusercontent.com/100xPercent/pop-pay-python/main/project_banner.png" alt="Point One Percent (AgentPay)" width="800"> </picture> </p>
Point One Percent — pop-pay
<p align="left"><i>it only takes <b>0.1%</b> of Hallucination to drain <b>100%</b> of your wallet.</i></p>
The runtime security layer for AI agent commerce. Drop-in CLI + MCP server. Card credentials are injected directly into the browser DOM via CDP — they never enter the agent's context window. One hallucinated prompt can't drain a wallet it can't see.
<p align="center"> <img src="https://raw.githubusercontent.com/100xPercent/pop-pay-python/main/assets/runtime_demo.gif" alt="Point One Percent — live CDP injection demo" width="800"> </p>
📄 Research Dataset & Reproduction — this repository hosts the open dataset and reproduction harness for "The Illusion of Single-Attacker Rankings". research: jump to Research Dataset & Reproduction.
Install
Choose your preferred method:
<details> <summary>Homebrew (macOS)</summary>
brew install 100xpercent/tap/pop-pay</details>
<details> <summary>curl (Linux / macOS) — bootstraps via npm; requires Node.js 18+</summary>
curl -fsSL https://raw.githubusercontent.com/100xPercent/pop-pay/main/install.sh | sh</details>
<details> <summary>npm (global)</summary>
npm install -g pop-pay</details>
<details> <summary>npx (no install — one-off runs)</summary>
npx -y pop-pay <command></details>
All install paths expose the same binaries: pop-pay, pop-launch, pop-init-vault, pop-unlock.
Also available as@100xpercent/mcp-server-pop-pay— identical package under the MCP@scope/mcp-server-<name>convention. Tracks the same version on every release.
Using Python? Check out pop-pay-python — pip install pop-pay. Same security model, same vault format, independent release cycle — safe to switch between runtimes.Quick Start (CLI)
1. Initialize the encrypted credential vault
pop-pay init-vaultThis encrypts your card credentials into ~/.config/pop-pay/vault.enc (AES-256-GCM). For stronger protection (blocks agents with shell access):
pop-pay init-vault --passphrase # one-time setup
pop-pay unlock # run once per session2. Launch Chrome with CDP remote debugging
pop-pay launchThis opens a Chromium instance on http://localhost:9222 that pop-pay injects credentials into. Your agent (via MCP, browser automation, or x402) then drives the checkout flow — card details never leave the browser process.
3. Plug into your agent
The CLI launches infrastructure; the actual payment tool calls come from your agent. Two supported paths:
- MCP server — add pop-pay to any MCP-compatible client (Claude Code, Cursor, Windsurf, OpenClaw). See MCP Server below.
- x402 HTTP — pay for API calls via the x402 payment protocol.
Full CLI reference: pop-pay --help.
MCP Server (optional)
Add to your MCP client
Standard config for any MCP-compatible client:
{
"mcpServers": {
"pop-pay": {
"command": "npx",
"args": ["-y", "pop-pay", "launch-mcp"],
"env": {
"POP_CDP_URL": "http://localhost:9222"
}
}
}
}<img src="https://img.shields.io/badge/VS_Code-VS_Code?style=flat-square&label=Install%20MCP%20Server&color=0098FF" alt="Install in VS Code"> <img alt="Install in VS Code Insiders" src="https://img.shields.io/badge/VS_Code_Insiders-VS_Code_Insiders?style=flat-square&label=Install%20MCP%20Server&color=24bfa5"> <img src="https://img.shields.io/badge/Cursor-Cursor?style=flat-square&label=Install%20MCP%20Server&color=5C2D91" alt="Install in Cursor">
<details> <summary>Claude Code</summary>
Claude Code uses its own CLI — the JSON config above is not needed.
claude mcp add --scope user pop-pay -- npx -y pop-pay launch-mcp--scope user makes it available across all projects. To remove: claude mcp remove pop-pay
</details>
<details> <summary>Cursor / Windsurf / VS Code</summary>
Add the JSON config above to:
- Cursor:
~/.cursor/mcp.json - Windsurf:
~/.codeium/windsurf/mcp_config.json - VS Code (Copilot):
.vscode/mcp.jsonin project root
</details>
<details> <summary>OpenClaw / NemoClaw</summary>
OpenClaw has its own CLI — the JSON config above is not needed.
openclaw mcp add pop-pay -- npx -y pop-pay launch-mcpOr add to ~/.openclaw/mcp_servers.json using the JSON config above.
For System Prompt templates and NemoClaw sandbox setup, see Integration Guide §4.
</details>
<details> <summary>Docker</summary>
docker-compose up -dRuns the MCP server + headless Chromium with CDP. Mount your encrypted vault from the host.
</details>
MCP Tools
| Tool | Description |
|---|---|
request_virtual_card | Issue a virtual card and inject credentials into the checkout page via CDP. Automatically scans the page for hidden prompt injections. |
request_purchaser_info | Auto-fill billing/contact info (name, address, email, phone). Automatically scans the page for hidden prompt injections. |
request_x402_payment | Pay for API calls via the x402 HTTP payment protocol. |
Tip for Claude Code users: Add the following to your project's CLAUDE.md to help the agent know when to call pop-pay: "When you encounter a payment form or checkout page, use the `request_virtual_card` tool. For billing/contact info forms, use `request_purchaser_info` first."Configuration
Core variables in ~/.config/pop-pay/.env. See ENV_REFERENCE.md for the full list.
| Variable | Default | Description |
|---|---|---|
POP_ALLOWED_CATEGORIES | ["aws","cloudflare"] | Approved vendor categories — see Categories Cookbook |
POP_MAX_PER_TX | 100.0 | Max USD per transaction |
POP_MAX_DAILY | 500.0 | Max USD per day |
POP_BLOCK_LOOPS | true | Block hallucination/retry loops |
POP_AUTO_INJECT | true | Enable CDP card injection |
POP_GUARDRAIL_ENGINE | keyword | keyword (zero-cost) or llm (semantic) |
Guardrail Mode
keyword (default) | llm | |
|---|---|---|
| Mechanism | Keyword matching on reasoning string | Semantic analysis via LLM |
| Cost | Zero — no API calls | One LLM call per request |
| Best for | Development, low-risk workflows | Production, high-value transactions |
To enable LLM mode, see Integration Guide §1.
Providers
| Provider | Description |
|---|---|
| BYOC (default) | Bring Your Own Card — encrypted vault credentials, local CDP injection. |
| Stripe Issuing | Real virtual cards via Stripe API. Requires POP_STRIPE_KEY. |
| Lithic | Multi-issuer adapter (Stripe Issuing / Lithic). |
| Mock | Test mode with generated card numbers for development. |
Priority: Stripe Issuing → BYOC Local → Mock.
Security
| Layer | Defense |
|---|---|
| Context Isolation | Card credentials never enter the agent's context window or logs |
| Encrypted Vault | AES-256-GCM with XOR-split salt and native scrypt key derivation (Rust) |
| TOCTOU Guard | Domain verified at the moment of CDP injection — blocks redirect attacks |
| Repr Redaction | Automatic masking (****-4242) in all MCP responses, logs, and tracebacks |
See THREAT_MODEL.md for the full STRIDE analysis and COMPLIANCE_FAQ.md for enterprise details.
Architecture
- TypeScript — MCP server, CDP injection engine, guardrails, CLI
- Rust (napi-rs) — Native security layer: XOR-split salt storage, scrypt key derivation
- Node.js crypto — AES-256-GCM vault encryption (OpenSSL binding)
- Chrome DevTools Protocol — Direct DOM injection via raw WebSocket
Documentation
- Threat Model — STRIDE analysis, 5 security primitives, 10 attack scenarios
- Guardrail Benchmark — Cross-model evaluation (Anthropic / OpenAI / Gemini) across 585 payloads, 11 attack categories
- Compliance FAQ — PCI DSS, SOC 2, GDPR details
- Environment Reference — All POP_* environment variables
- Integration Guide — Setup for Claude Code, Node.js SDK, and browser agents
- Categories Cookbook — POP_ALLOWED_CATEGORIES patterns and examples
Research Dataset & Reproduction
This repository hosts the open-source dataset and harness for the cross-vendor attacker-stability methodology described in the corresponding research paper. Reviewer/researcher reproduction artifacts:
- Corpus (585 attack payloads, 11 categories):
tests/redteam/corpus/ attacks.json— full payload set with category labelsGENERATION.md— corpus generation protocolschema.json— payload schema- Run JSONLs (26,325 rows, 9 models × 585 payloads × N=5):
tests/redteam/runs/ - PRIMARY whitebox-no-feedback runs:
runs/adaptive/2026-04-28T19-50-* - Static panel runs:
runs/static/ - Prompt-ablation (v3 / strict / paranoid):
runs/ablation/ - Manifest hashes:
tests/redteam/runs/MANIFEST.sha256— byte-level integrity for all artifacts - Croissant 1.0 metadata (Core + RAI fields):
paper-artifacts/croissant.json - Reproduction scripts (regenerate paper tables/figures from JSONL):
python3 paper-artifacts/gen-tables.py --table all— Tab.~bypassk / threat-ablation / cross-vendorpython3 paper-artifacts/gen-taxonomy-map.py— Fig.~taxonomy-map- License: corpus CC BY-SA 4.0, harness MIT.
For dataset schema, statistical methodology (bootstrap CI, Holm-Bonferroni, McNemar), full from-scratch re-collection instructions, JSONL row data dictionary, and responsible-disclosure policy, see [docs/PAPER_REPRODUCTION.md](docs/PAPER_REPRODUCTION.md).
License
MIT