Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
md If the user chooses Revert, register that URL in the harness's remote MCP settings using the harness's own setup instructions. Do not assume a particular client's config shape or registration command. Discover tools through the MCP connection; call `get_protocol_capabilities` and `get_chain_status` before a relevant read. Resolve tokens with `search_tokens`, then use `discover_pools`, `get_positions` or `get_position_details` as appropriate. Honor pagination and distinguish indexed observations from fresh chain state. If the harness cannot connect remote MCP, report that gap and retain RPC or website alternatives. For an unsigned plan, use only a currently advertised `prepare_*` capability matching the exact network, protocol, position custody and action. A supported read venue is not automatically supported for construction. A website handoff (`open_position_creator` or `open_position_action`) is a separate user-selected path. Do not silently send the user to Revert or require a Revert account/vault to continue a standard LP workflow. Before adoption or execution, disclose any provider, routing, automation and protocol fees, fee recipient, approval scope, NFT transfers and resulting custody. If fees or custody are unresolved, keep the plan blocked; never infer that public/no-key access means fee-free transactions. Do not inject referral, affiliate or builder fees. Collateralization and borrowing are separate financial actions and must not appear as incidental setup or ordinary LP maintenance.