agentlatch-security 0.4.0__py3-none-any.whl

agent_latch/manifest.py

@@ -0,0 +1,256 @@
+"""Checks for agent manifests: tool definitions, permissions, and prompt templates.
+
+Like the source rules, these are heuristics over declared configuration. They do not
+observe what the agent actually does at runtime.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+from agent_latch.findings import Finding
+from agent_latch.prompts import check_prompt_text
+from agent_latch.rules import MANIFEST_NAMES, scan_secrets
+from agent_latch.yamlload import LineDict as _LineDict
+from agent_latch.yamlload import LineLoader as _LineLoader
+from agent_latch.yamlload import line_of as _line_of
+
+_HIGH_RISK_CAPABILITIES = {
+    "shell",
+    "exec",
+    "code_exec",
+    "code_execution",
+    "python",
+    "subprocess",
+    "filesystem:write",
+    "fs:write",
+    "file_write",
+    "filesystem:delete",
+    "database:write",
+    "db:write",
+    "email:send",
+    "payments",
+    "payments:write",
+    "sudo",
+    "admin",
+}
+_CODE_EXECUTION_CAPABILITIES = {"shell", "exec", "code_exec", "code_execution", "python", "subprocess"}
+_WILDCARDS = {"*", "all", "any"}
+_APPROVAL_KEYS = ("requires_approval", "human_in_the_loop", "require_confirmation")
+_CAPABILITY_KEYS = ("capabilities", "permissions", "scopes")
+_ENDPOINT_KEYS = ("endpoint", "url", "base_url", "server")
+_NO_AUTH_VALUES = {"none", "false", "anonymous", "no", "off", ""}
+
+
+class ManifestError(ValueError):
+    """Raised when a manifest cannot be read or parsed."""
+
+
+def find_manifest(target: Path) -> Path | None:
+    directory = target if target.is_dir() else target.parent
+    for name in MANIFEST_NAMES:
+        candidate = directory / name
+        if candidate.is_file():
+            return candidate
+    return None
+
+
+def load_manifest(manifest: Path) -> _LineDict:
+    try:
+        data = yaml.load(manifest.read_text(encoding="utf-8"), Loader=_LineLoader)  # SafeLoader subclass
+    except OSError as exc:
+        raise ManifestError(f"could not read {manifest}: {exc.strerror or exc}") from exc
+    except yaml.YAMLError as exc:
+        raise ManifestError(f"invalid YAML in {manifest}: {exc}") from exc
+    if not isinstance(data, _LineDict):
+        raise ManifestError(f"{manifest} must contain a YAML mapping at the top level")
+    return data
+
+
+def _display_path(path: Path, root: Path) -> str:
+    try:
+        return path.resolve().relative_to(root).as_posix()
+    except ValueError:
+        return path.as_posix()
+
+
+def _as_list(value: Any) -> list[Any]:
+    if value is None:
+        return []
+    return value if isinstance(value, list) else [value]
+
+
+def _truthy(value: Any) -> bool:
+    if isinstance(value, str):
+        return value.strip().lower() in {"true", "yes", "always", "required", "on"}
+    return value is True
+
+
+def _iter_tools(manifest: _LineDict) -> list[_LineDict]:
+    tools = [tool for tool in _as_list(manifest.get("tools")) if isinstance(tool, _LineDict)]
+    for agent in _as_list(manifest.get("agents")):
+        if isinstance(agent, _LineDict):
+            tools.extend(tool for tool in _as_list(agent.get("tools")) if isinstance(tool, _LineDict))
+    return tools
+
+
+def _check_tool(tool: _LineDict, path: str) -> list[Finding]:
+    findings: list[Finding] = []
+    name = str(tool.get("name", "<unnamed>"))
+    capability_key = next((key for key in _CAPABILITY_KEYS if key in tool), None)
+    capabilities = [str(item).strip().lower() for item in _as_list(tool.get(capability_key))] if capability_key else []
+    approved = any(_truthy(tool.get(key)) for key in _APPROVAL_KEYS)
+
+    wildcards = [cap for cap in capabilities if cap in _WILDCARDS or cap.endswith(":*")]
+    if wildcards:
+        findings.append(
+            Finding(
+                rule_id="AGENTLATCH-MAN002",
+                title="Tool grants wildcard permissions",
+                severity="high",
+                message=f"Tool '{name}' declares unbounded permissions. Scope it to the specific actions the agent needs.",
+                path=path,
+                line=_line_of(tool, capability_key or "name"),
+                column=1,
+                owasp=("ASI02", "ASI03"),
+                confidence="high",
+                evidence=f"tool '{name}' {capability_key}: {', '.join(wildcards)}",
+            )
+        )
+
+    risky = [cap for cap in capabilities if cap in _HIGH_RISK_CAPABILITIES]
+    if risky and not approved:
+        executes_code = any(cap in _CODE_EXECUTION_CAPABILITIES for cap in risky)
+        owasp = ("ASI02", "ASI05", "ASI09") if executes_code else ("ASI02", "ASI03", "ASI09")
+        findings.append(
+            Finding(
+                rule_id="AGENTLATCH-MAN001",
+                title="High-risk tool without human approval",
+                severity="high",
+                message=(
+                    f"Tool '{name}' can perform high-impact actions with no approval gate declared. "
+                    "Require human confirmation or narrow the capability."
+                ),
+                path=path,
+                line=_line_of(tool, capability_key or "name"),
+                column=1,
+                owasp=owasp,
+                confidence="medium",
+                evidence=f"tool '{name}' {capability_key}: {', '.join(risky)}; no {'/'.join(_APPROVAL_KEYS)}",
+            )
+        )
+
+    endpoint_key = next((key for key in _ENDPOINT_KEYS if key in tool), None)
+    if endpoint_key:
+        endpoint = str(tool.get(endpoint_key))
+        if "auth" not in tool:
+            explicit = False
+            missing = True
+        else:
+            explicit = True
+            auth = tool.get("auth")
+            missing = auth is None or auth is False or (isinstance(auth, str) and auth.strip().lower() in _NO_AUTH_VALUES)
+        if missing:
+            findings.append(
+                Finding(
+                    rule_id="AGENTLATCH-MAN003",
+                    title="Remote tool without authentication",
+                    severity="medium",
+                    message=(
+                        f"Tool '{name}' calls a remote endpoint "
+                        + ("with authentication explicitly disabled. " if explicit else "with no auth declared. ")
+                        + "Authenticate tool calls and scope credentials to this tool."
+                    ),
+                    path=path,
+                    line=_line_of(tool, "auth" if explicit else endpoint_key),
+                    column=1,
+                    owasp=("ASI03", "ASI02"),
+                    confidence="medium" if explicit else "low",
+                    evidence=f"tool '{name}' {endpoint_key}: {endpoint}; auth: {tool.get('auth') if explicit else '<missing>'}",
+                )
+            )
+    return findings
+
+
+_check_prompt_text = check_prompt_text
+
+
+def _block_offset(agent: _LineDict, key: str) -> int:
+    """Literal block scalars (|, >) start on the line after their key."""
+    return _line_of(agent, key) + 1
+
+
+def _check_agent_prompts(
+    agent: _LineDict,
+    manifest_path: Path,
+    display: str,
+    root: Path,
+    max_file_bytes: int,
+) -> list[Finding]:
+    findings: list[Finding] = []
+    name = str(agent.get("name", "<unnamed>"))
+
+    for key, is_system in (("system_prompt", True), ("prompt", False)):
+        text = agent.get(key)
+        if isinstance(text, str):
+            start = _block_offset(agent, key) if "\n" in text else _line_of(agent, key)
+            label = f"Agent '{name}' {key}"
+            findings.extend(_check_prompt_text(text, display, start, label, is_system))
+
+    referenced: list[tuple[str, bool, str]] = []
+    for key in ("system_prompt_file", "system_prompt_template"):
+        if isinstance(agent.get(key), str):
+            referenced.append((agent[key], True, key))
+    for key in ("prompt_templates", "prompt_template", "prompt_files"):
+        referenced.extend((str(item), False, key) for item in _as_list(agent.get(key)))
+
+    for reference, is_system, key in referenced:
+        template = (manifest_path.parent / reference).resolve()
+        template_display = _display_path(template, root)
+        try:
+            if template.stat().st_size > max_file_bytes:
+                continue
+            text = template.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            findings.append(
+                Finding(
+                    rule_id="AGENTLATCH-MAN000",
+                    title="Referenced prompt file not found",
+                    severity="info",
+                    message=f"Agent '{name}' references a prompt file that could not be read, so it was not scanned.",
+                    path=display,
+                    line=_line_of(agent, key),
+                    column=1,
+                    owasp=(),
+                    confidence="high",
+                    evidence=f"{key}: {reference}",
+                )
+            )
+            continue
+        label = f"Prompt template for agent '{name}'"
+        findings.extend(_check_prompt_text(text, template_display, 1, label, is_system))
+        if not template.is_relative_to(root):
+            # scan_project covers every file inside the target; templates outside it are checked here.
+            findings.extend(scan_secrets(template, template.parent, text))
+    return findings
+
+
+def scan_manifest(manifest_path: Path, root: Path, max_file_bytes: int = 1_000_000) -> list[Finding]:
+    """Audit tool definitions and prompts declared in an AgentLatch agent manifest."""
+    manifest_path = manifest_path.resolve()
+    root = root.resolve() if root.is_dir() else root.resolve().parent
+    manifest = load_manifest(manifest_path)
+    display = _display_path(manifest_path, root)
+
+    findings: list[Finding] = []
+    for tool in _iter_tools(manifest):
+        findings.extend(_check_tool(tool, display))
+    for agent in _as_list(manifest.get("agents")):
+        if isinstance(agent, _LineDict):
+            findings.extend(_check_agent_prompts(agent, manifest_path, display, root, max_file_bytes))
+
+    # A template shared by several agents would otherwise be reported once per agent.
+    return sorted(set(findings), key=lambda finding: (finding.path, finding.line, finding.rule_id))

agent_latch/oversight.py

@@ -0,0 +1,225 @@
+"""Human-oversight and runaway-loop checks that work from source code alone.
+
+- AG006: human approval explicitly turned off, so the agent acts without confirmation
+  (AutoGen human_input_mode="NEVER" with code execution, auto_approve=True,
+  permission_mode="bypassPermissions", require_approval="never", ...).
+                                  (ASI09 Human-Agent Trust Exploitation; ASI02 / ASI05)
+- AG007: an agent loop with no effective bound: max_iterations=None, a very high iteration
+  or recursion limit, or `while True:` around an agent call with no way out.
+                                  (ASI08 Cascading Failures)
+
+Single-file, name-based heuristics over the AST. Nothing is imported or executed.
+"""
+
+from __future__ import annotations
+
+import ast
+
+from agent_latch.astutil import walk
+from agent_latch.findings import Finding
+
+# ---------------------------------------------------------------- shared helpers
+
+
+def _dotted(node: ast.AST | None) -> str:
+    if isinstance(node, ast.Name):
+        return node.id
+    if isinstance(node, ast.Attribute):
+        base = _dotted(node.value)
+        return f"{base}.{node.attr}" if base else node.attr
+    if isinstance(node, ast.Call):
+        return _dotted(node.func)
+    return ""
+
+
+def _last(name: str) -> str:
+    return name.rsplit(".", 1)[-1]
+
+
+def _literal(node: ast.AST | None) -> object:
+    return node.value if isinstance(node, ast.Constant) else ...
+
+
+# ---------------------------------------------------------------- AG006: approval disabled
+
+# Keyword set to True turns off confirmation before tool or code execution.
+_AUTO_APPROVE_KWARGS = {
+    "auto_approve",
+    "auto_approve_tools",
+    "auto_confirm",
+    "skip_approval",
+    "skip_confirmation",
+    "bypass_approval",
+    "dangerously_skip_permissions",
+    "yolo",
+}
+# Keyword whose string value says "never ask a human".
+_APPROVAL_MODE_KWARGS = {"approval_mode", "approval_policy", "permission_mode", "require_approval"}
+_NO_APPROVAL_VALUES = {"never", "none", "auto", "always_approve", "bypasspermissions", "full-auto", "yolo"}
+
+
+def _code_execution_enabled(call: ast.Call) -> bool:
+    """AutoGen executes code unless code_execution_config is False or None."""
+    for keyword in call.keywords:
+        if keyword.arg == "code_execution_config":
+            return _literal(keyword.value) not in (False, None)
+        if keyword.arg == "code_executor":
+            return _literal(keyword.value) is not None
+    return False
+
+
+def _approval_findings(tree: ast.Module, path: str) -> list[Finding]:
+    results: list[Finding] = []
+
+    def add(node: ast.AST, severity: str, owasp: tuple[str, ...], evidence: str, why: str) -> None:
+        results.append(
+            Finding(
+                rule_id="AGENTLATCH-AG006",
+                title="Human approval disabled for agent actions",
+                severity=severity,
+                message=(
+                    f"{why} A user or reviewer can be steered into trusting actions they never see. "
+                    "Keep a human confirmation step for code execution and other high-impact actions."
+                ),
+                path=path,
+                line=node.lineno,
+                column=node.col_offset + 1,
+                owasp=owasp,
+                confidence="high" if severity == "high" else "medium",
+                evidence=evidence,
+            )
+        )
+
+    for node in walk(tree):
+        if not isinstance(node, ast.Call):
+            continue
+        callee = _last(_dotted(node.func)) or "call"
+        for keyword in node.keywords:
+            value = _literal(keyword.value)
+            if keyword.arg == "human_input_mode" and value == "NEVER":
+                if _code_execution_enabled(node):
+                    add(node, "high", ("ASI09", "ASI05"), f'{callee}(human_input_mode="NEVER", code execution on)',
+                        f"{callee} runs model-written code with no human in the loop.")
+            elif keyword.arg in _AUTO_APPROVE_KWARGS and value is True:
+                add(node, "high", ("ASI09", "ASI02"), f"{callee}({keyword.arg}=True)",
+                    f"{keyword.arg}=True approves the agent's actions automatically.")
+            elif (
+                keyword.arg in _APPROVAL_MODE_KWARGS
+                and isinstance(value, str)
+                and value.strip().lower() in _NO_APPROVAL_VALUES
+            ):
+                add(node, "high", ("ASI09", "ASI02"), f"{callee}({keyword.arg}={value!r})",
+                    f"{keyword.arg}={value!r} lets the agent act without asking a human.")
+    return results
+
+
+# ---------------------------------------------------------------- AG007: unbounded loops
+
+_LIMIT_KWARGS = {
+    "max_iterations",
+    "max_iter",
+    "max_turns",
+    "max_round",
+    "max_rounds",
+    "max_steps",
+    "recursion_limit",
+}
+# Above this many steps, a limit no longer works as a circuit breaker. LangGraph defaults to 25,
+# LangChain AgentExecutor to 15, CrewAI max_iter to 20-25.
+_LIMIT_THRESHOLD = 100
+_AGENT_METHODS = {"invoke", "ainvoke", "kickoff", "kickoff_async", "initiate_chat", "run_sync"}
+# Generic method names count only when the receiver looks like an agent, crew, or graph.
+_GENERIC_METHODS = {"run", "arun", "chat", "start", "stream", "astream"}
+_AGENT_RECEIVER_HINTS = ("agent", "crew", "graph", "executor", "chain", "app", "team", "runner", "swarm")
+
+
+def _limit_problem(node: ast.AST | None) -> str | None:
+    value = _literal(node)
+    if value is None:
+        return "None"
+    if isinstance(value, (int, float)) and not isinstance(value, bool) and value > _LIMIT_THRESHOLD:
+        return str(value)
+    if isinstance(node, ast.Attribute) and _dotted(node) in {"math.inf", "sys.maxsize"}:
+        return _dotted(node)
+    return None
+
+
+def _is_agent_call(call: ast.Call) -> bool:
+    if not isinstance(call.func, ast.Attribute):
+        return False
+    method = call.func.attr
+    if method in _AGENT_METHODS:
+        return True
+    receiver = _dotted(call.func.value).lower()
+    return method in _GENERIC_METHODS and any(hint in receiver for hint in _AGENT_RECEIVER_HINTS)
+
+
+def _loop_exits(loop: ast.While) -> bool:
+    """True if the loop body can leave the loop: break, return, raise, or sys.exit()."""
+    stack: list[ast.AST] = list(loop.body)
+    while stack:
+        node = stack.pop()
+        if isinstance(node, (ast.Break, ast.Return, ast.Raise)):
+            return True
+        if isinstance(node, ast.Call) and _dotted(node.func) in {"sys.exit", "exit", "quit", "os._exit"}:
+            return True
+        # A break inside a nested loop or function does not leave this loop.
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.Lambda, ast.ClassDef)):
+            continue
+        if isinstance(node, (ast.For, ast.AsyncFor, ast.While)):
+            stack.extend(child for child in ast.walk(node) if isinstance(child, (ast.Return, ast.Raise)))
+            continue
+        stack.extend(ast.iter_child_nodes(node))
+    return False
+
+
+def _loop_findings(tree: ast.Module, path: str) -> list[Finding]:
+    results: list[Finding] = []
+    for node in walk(tree):
+        if isinstance(node, ast.Call):
+            callee = _last(_dotted(node.func)) or "call"
+            for keyword in node.keywords:
+                if keyword.arg in _LIMIT_KWARGS:
+                    problem = _limit_problem(keyword.value)
+                    if problem:
+                        results.append(_loop_finding(keyword.value, path, f"{callee}({keyword.arg}={problem})",
+                                                     f"{keyword.arg}={problem} gives the agent no effective step limit."))
+        elif isinstance(node, ast.Dict):
+            for key, value in zip(node.keys, node.values):
+                if isinstance(key, ast.Constant) and key.value in _LIMIT_KWARGS:
+                    problem = _limit_problem(value)
+                    if problem:
+                        results.append(_loop_finding(value, path, f'{{"{key.value}": {problem}}}',
+                                                     f"{key.value}={problem} gives the agent no effective step limit."))
+        elif isinstance(node, ast.While) and _literal(node.test) is True and not _loop_exits(node):
+            calls = [child for child in walk(node) if isinstance(child, ast.Call) and _is_agent_call(child)]
+            if calls:
+                results.append(_loop_finding(node, path, f"while True: ... {_dotted(calls[0].func)}(...) with no exit",
+                                             "An agent is called in an endless loop with no break, return, or raise."))
+    return results
+
+
+def _loop_finding(node: ast.AST, path: str, evidence: str, why: str) -> Finding:
+    return Finding(
+        rule_id="AGENTLATCH-AG007",
+        title="Agent loop without an effective limit",
+        severity="medium",
+        message=(
+            f"{why} One bad step can then repeat or fan out without stopping. "
+            "Set a small step limit, a timeout, or a circuit breaker."
+        ),
+        path=path,
+        line=node.lineno,
+        column=node.col_offset + 1,
+        owasp=("ASI08",),
+        confidence="medium",
+        evidence=evidence,
+    )
+
+
+# ---------------------------------------------------------------- entry point
+
+
+def scan_oversight(tree: ast.Module, path: str) -> list[Finding]:
+    """AG006 and AG007 for one parsed Python file. scan_python lowers test-file severity."""
+    return [*_approval_findings(tree, path), *_loop_findings(tree, path)]

agent_latch/owasp.py

@@ -0,0 +1,105 @@
+"""OWASP Top 10 for Agentic Applications 2026: the single source of category IDs and names.
+
+Names follow the table of contents of the OWASP publication
+"OWASP Top 10 for Agentic Applications 2026" (OWASP-Top-10-for-Agentic-Applications-2026-12.6-1.pdf).
+The mapping is informational; it is not a compliance assessment or an OWASP endorsement.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterable
+from typing import Any, Protocol
+
+OWASP_AGENTIC_VERSION = "2026"
+OWASP_AGENTIC_TITLE = "OWASP Top 10 for Agentic Applications 2026"
+OWASP_AGENTIC_URL = (
+    "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/"
+)
+
+ASI_CATEGORIES: dict[str, str] = {
+    "ASI01": "Agent Goal Hijack",
+    "ASI02": "Tool Misuse and Exploitation",
+    "ASI03": "Identity and Privilege Abuse",
+    "ASI04": "Agentic Supply Chain Vulnerabilities",
+    "ASI05": "Unexpected Code Execution (RCE)",
+    "ASI06": "Memory & Context Poisoning",
+    "ASI07": "Insecure Inter-Agent Communication",
+    "ASI08": "Cascading Failures",
+    "ASI09": "Human-Agent Trust Exploitation",
+    "ASI10": "Rogue Agents",
+}
+
+# Every category a rule can emit. Rules whose mapping depends on context (MAN001) list all options.
+# Keep in sync with the rules and with the coverage table in AGENTS.md.
+RULE_CATEGORIES: dict[str, tuple[str, ...]] = {
+    "AGENTLATCH-PY001": ("ASI05", "ASI02"),
+    "AGENTLATCH-PY002": ("ASI05", "ASI02"),
+    "AGENTLATCH-PY003": ("ASI02",),
+    "AGENTLATCH-AG001": ("ASI02", "ASI03"),
+    "AGENTLATCH-AG002": ("ASI05", "ASI02"),
+    "AGENTLATCH-AG003": ("ASI01",),
+    "AGENTLATCH-AG004": ("ASI02", "ASI03", "ASI05", "ASI09"),
+    "AGENTLATCH-AG005": ("ASI02", "ASI03", "ASI05"),
+    "AGENTLATCH-AG006": ("ASI09", "ASI02", "ASI05"),
+    "AGENTLATCH-AG007": ("ASI08",),
+    "AGENTLATCH-SEC001": ("ASI03", "ASI04"),
+    "AGENTLATCH-DEP001": ("ASI04",),
+    "AGENTLATCH-MAN000": (),
+    "AGENTLATCH-MAN001": ("ASI02", "ASI03", "ASI05", "ASI09"),
+    "AGENTLATCH-MAN002": ("ASI02", "ASI03"),
+    "AGENTLATCH-MAN003": ("ASI03", "ASI02"),
+    "AGENTLATCH-PRM001": ("ASI01",),
+    "AGENTLATCH-PRM002": ("ASI01",),
+}
+
+
+class _HasMapping(Protocol):
+    rule_id: str
+    owasp: tuple[str, ...]
+
+
+def category_name(category_id: str) -> str:
+    return ASI_CATEGORIES.get(category_id, "Unknown category")
+
+
+def category_label(category_id: str) -> str:
+    """'ASI05 Unexpected Code Execution (RCE)'."""
+    return f"{category_id} {category_name(category_id)}"
+
+
+def category_entries(category_ids: Iterable[str]) -> list[dict[str, str]]:
+    return [{"id": cid, "name": category_name(cid)} for cid in category_ids]
+
+
+def rules_for_category(category_id: str) -> list[str]:
+    return sorted(rule for rule, cats in RULE_CATEGORIES.items() if category_id in cats)
+
+
+def coverage(findings: Iterable[_HasMapping]) -> list[dict[str, Any]]:
+    """Per-category finding counts, plus whether AgentLatch has any check for the category.
+
+    `has_checks` means a rule exists; it does not mean the category is fully covered,
+    and some rules only run with a manifest or --dependencies.
+    """
+    counts = dict.fromkeys(ASI_CATEGORIES, 0)
+    for finding in findings:
+        for category_id in set(finding.owasp):
+            if category_id in counts:
+                counts[category_id] += 1
+    return [
+        {
+            "id": category_id,
+            "name": name,
+            "finding_count": counts[category_id],
+            "has_checks": bool(rules_for_category(category_id)),
+            "rules": rules_for_category(category_id),
+        }
+        for category_id, name in ASI_CATEGORIES.items()
+    ]
+
+
+def coverage_status(entry: dict[str, Any]) -> str:
+    if not entry["has_checks"]:
+        return "no checks yet"
+    count = entry["finding_count"]
+    return f"{count} finding(s)" if count else "no findings from enabled checks"

agent_latch/prompts.py

@@ -0,0 +1,90 @@
+"""Prompt-text checks (PRM001, PRM002) shared by manifest and source-code scanning."""
+
+from __future__ import annotations
+
+import re
+
+from agent_latch.findings import Finding
+
+INJECTION_SIGNATURES = (
+    re.compile(r"(?i)\bignore\s+(?:all\s+)?(?:the\s+)?(?:previous|prior|above|earlier)\s+(?:instructions|prompts|rules)"),
+    re.compile(r"(?i)\bdisregard\s+(?:all\s+)?(?:the\s+|your\s+)?(?:previous|prior|above|system)\s+(?:instructions|prompts|rules)"),
+    re.compile(r"(?i)\byou\s+are\s+now\s+(?:in\s+)?(?:developer\s+mode|dan\b|jailbroken|unrestricted)"),
+    re.compile(r"(?i)\b(?:reveal|print|output)\s+(?:your|the)\s+(?:system\s+prompt|hidden\s+instructions)"),
+    re.compile(r"(?i)\bwithout\s+(?:telling|informing|notifying)\s+the\s+user\b"),
+)
+UNTRUSTED_PLACEHOLDER = re.compile(
+    r"(\{\{\s*|\$\{|\{)\s*(\w*(?:user|input|query|message|request|question)\w*)\s*(?:\}\}|\})",
+    re.IGNORECASE,
+)
+# Names like {message_count} or {user_id} hold numbers or identifiers, not user-written text.
+_NON_TEXT_SUFFIX = re.compile(
+    r"(?i)(?:_|^)(?:count|counts|id|ids|len|length|total|num|number|index|idx|size|type|time|at|ts)$"
+)
+
+
+def untrusted_placeholder(line: str) -> re.Match[str] | None:
+    """First user-input-like placeholder on the line that could hold free text."""
+    for match in UNTRUSTED_PLACEHOLDER.finditer(line):
+        if not _NON_TEXT_SUFFIX.search(match.group(2).split(".")[-1]):
+            return match
+    return None
+
+
+def check_prompt_text(
+    text: str,
+    path: str,
+    base_line: int,
+    label: str,
+    is_system: bool,
+    base_column: int = 1,
+) -> list[Finding]:
+    """Run PRM001 (injection phrases) and, for system prompts, PRM002 (user-input placeholders).
+
+    `base_column` applies to the first line only, for strings that start mid-line in source code.
+    """
+    findings: list[Finding] = []
+    for offset, line in enumerate(text.splitlines()):
+        column_shift = base_column - 1 if offset == 0 else 0
+        for signature in INJECTION_SIGNATURES:
+            match = signature.search(line)
+            if match:
+                findings.append(
+                    Finding(
+                        rule_id="AGENTLATCH-PRM001",
+                        title="Prompt-injection signature in prompt",
+                        severity="medium",
+                        message=(
+                            f"{label} contains an instruction-override phrase commonly used in prompt injection. "
+                            "Check whether this text came from an untrusted source."
+                        ),
+                        path=path,
+                        line=base_line + offset,
+                        column=match.start() + 1 + column_shift,
+                        owasp=("ASI01",),
+                        confidence="medium",
+                        evidence=f'"{match.group(0)[:80]}"',
+                    )
+                )
+                break
+        if is_system:
+            match = untrusted_placeholder(line)
+            if match:
+                findings.append(
+                    Finding(
+                        rule_id="AGENTLATCH-PRM002",
+                        title="Untrusted input interpolated into system prompt",
+                        severity="medium",
+                        message=(
+                            f"{label} inserts a user-controlled variable into system-level instructions. "
+                            "Pass user input in the user turn, delimited and labeled as data."
+                        ),
+                        path=path,
+                        line=base_line + offset,
+                        column=match.start() + 1 + column_shift,
+                        owasp=("ASI01",),
+                        confidence="low",
+                        evidence=f"placeholder {match.group(0)}",
+                    )
+                )
+    return findings