prompt.exfiltration_link
A Markdown image or link whose URL query string carries an unresolved template placeholder.
Source: rules.
What it looks at#
Markdown image () and link ([text](url)) syntax whose URL contains an
unresolved {...} template placeholder (plain or percent-encoded, %7B...%7D).
Why it matters#
This is the shape of a classic indirect-prompt-injection data-exfiltration attempt: get
the model to render  into its
output. If that output is shown in a Markdown-rendering client, the client fetches the
image, and the attacker’s server logs whatever the model filled the placeholder with — a
system prompt, a snippet of conversation history, anything the attacker’s injected
instructions told the model to insert. A real, author-provided image or link URL is a
fixed string; a URL containing an unresolved template placeholder is not something a
legitimate message would ever contain verbatim.
What to do#
High severity — on its own this pushes the verdict to block. If your product renders
model output as Markdown (including auto-loading images), this check exists specifically
for you — treat a hit as a signal to strip the offending link before rendering, not just
before sending the text onward.