Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md | `list.remove(someInt)` on a `List<Integer>` | The `remove(int)` overload wins over `remove(Object)` — it removes by INDEX and can throw `IndexOutOfBoundsException` | `list.remove(Integer.valueOf(x))` | | `SimpleDateFormat` in a static or shared field | Not thread-safe; under load it returns silently wrong dates rather than throwing | `DateTimeFormatter` — immutable and thread-safe (`datetime.md`) | | `Collectors.toMap(k, v)` on data where a key can repeat | Throws `IllegalStateException` only for inputs that collide, so it passes tests and fails in production | Supply a merge function: `toMap(k, v, (a, b) -> b)` | | `@Transactional` called from another method of the same class | Self-invocation bypasses the proxy: no transaction, no warning, no rollback | Move the annotated method into another bean (`spring.md`) | | JUnit 4 annotations left in a JUnit 5 project | `org.junit.Test` classes are simply not executed by the Jupiter engine — a green build running zero tests | One engine, or add the vintage engine deliberately (`testing.md`) | | `Files.lines()` / `Files.walk()` outside try-with-resources | Holds the file handle until GC; the failure shows up hours later as "Too many open files" | try-with-resources (Core Rule 4) | | `printStackTrace()` in server code | Writes to stderr, detached from the request context and invisible to log aggregation | Logger with the throwable |