All five categories default to CRITICAL or HIGH, and no pattern overrides downward. Across the 30 shipped patterns there is not a single MEDIUM and not a single LOW finding possible.
Consequences:
- Everything is an emergency, so nothing is — classic alert fatigue.
- SCAN-03 ("severity classifier CRITICAL/HIGH/MEDIUM/LOW") is nominally met but functionally half-implemented.
- A
--fail-on <severity> flag is meaningless until the distribution is real.
Proposed fix
Re-grade all 30 patterns against explicit criteria:
- CRITICAL — unambiguous, actionable payload with no plausible benign reading (
ignore all previous instructions, zero-width sequences, exfil-to-URL).
- HIGH — strong signal, rare benign use (
DAN mode, SYSTEM OVERRIDE).
- MEDIUM — suspicious in context, plausible benign use (
fetch https://…, you are now …).
- LOW — heuristics and weak signals (single zero-width char,
IMPORTANT: framing).
Write the criteria into PATTERNS.md so community contributions grade themselves. Blocks the --fail-on work.
Audit ref: H-02
All five categories default to CRITICAL or HIGH, and no pattern overrides downward. Across the 30 shipped patterns there is not a single MEDIUM and not a single LOW finding possible.
Consequences:
--fail-on <severity>flag is meaningless until the distribution is real.Proposed fix
Re-grade all 30 patterns against explicit criteria:
ignore all previous instructions, zero-width sequences, exfil-to-URL).DAN mode,SYSTEM OVERRIDE).fetch https://…,you are now …).IMPORTANT:framing).Write the criteria into
PATTERNS.mdso community contributions grade themselves. Blocks the--fail-onwork.Audit ref: H-02