Your AI's Instructions Are an Attack Surface.
CodeMarine Scans Every One.
Rules files, agent skills and hook configs carry the same weight as vendor instructions. The AI can't tell the difference. A poisoned .cursorrules file can make your AI use eval() instead of safe alternatives.
43 detection patterns across every instruction file format. Deterministic scanning that can't be tricked by prompt injection.
Every instruction file. Every format.
43 detection patterns scan every file that can influence your AI's behavior.
Rules files
.cursorrules Cursor project rules
.cursor/rules/*.mdc Cursor scoped rules
copilot-instructions.md GitHub Copilot instructions
copilot-review-instructions.md Copilot review instructions
CLAUDE.md Claude Code project instructions
.claude/ Claude Code settings and memory
.windsurfrules Windsurf rules
.gooserc Goose rules
Agent skill files
SKILL.md Agent skill definitions
AGENTS.md Agent configuration
SOUL.md Agent personality/behavior
MEMORY.md Agent memory files
OPERATIONS.md Agent operations
IDENTITY.md Agent identity
Hook config directories
.cursor/hooks.json .windsurf/hooks.json .clinerules/hooks/ .claude/settings.json 8 threat categories. 43 patterns.
Every pattern is deterministic. No AI interpretation. No hallucination. The pattern matches or it doesn't.
BIDI Override Attacks
Invisible Unicode characters (U+202E) that reverse text direction, hiding malicious instructions. Invisible in editors and on GitHub.
Prompt Injection
Attempts to override system instructions or break out of AI context. Directives that tell the AI to ignore previous instructions or adopt new behavior.
External URL Exfiltration
Directives to send data to non-whitelisted domains. Validated against a whitelist of 25+ legitimate domains to reduce false positives.
Encoded Payloads
Base64 and hex encoded malicious content embedded in instruction files. Attackers encode payloads to bypass simple text-matching defenses.
Shell Injection in Config Values
Command injection hidden in configuration strings. Hook configs and settings files that execute arbitrary shell commands when triggered.
Invisible Unicode Manipulation
Mixed-script tokens and homograph attacks. Characters from different Unicode scripts that look identical but have different code points.
MCP Tool Abuse
Overly permissive MCP tool permissions that grant agents access to filesystem, network or system operations beyond what is needed.
Data Exfiltration Patterns
Known exfiltration directive syntax that instructs agents to collect and transmit sensitive data like API keys, tokens and credentials.
Why this matters
Same weight as vendor instructions
Rules files carry the same authority as the AI vendor's own system prompt. The AI treats .cursorrules the same as instructions from Cursor itself.
Invisible in editors and on GitHub
BIDI characters are invisible in every major code editor and in GitHub's web UI. You can review a rules file line by line and never see the attack.
Supply chain risk
Shared rules files in open source repos, starter templates and boilerplates are a supply chain vector. Clone a repo with a poisoned .cursorrules and your AI is compromised.
Weaponized coding patterns
A malicious .cursorrules can make Cursor use eval() instead of safe alternatives, disable input validation or suppress security warnings.
Deterministic scanning can't be tricked
AI-based security tools process rules files as text input, making them vulnerable to the same prompt injection they would need to detect. CodeMarine uses deterministic pattern matching. It does not interpret instructions. It cannot be manipulated by prompt injection, social engineering or adversarial prompts. The pattern matches or it doesn't.
Detection in action
What a poisoned rules file looks like to CodeMarine.
Protect your AI's instruction surface
43 patterns. Every rules file format. Every agent skill. Deterministic.
Core scans on save and does not upload your source. Detection is deterministic. A prompt that tricks an AI reviewer does not change a rule match.
Read the complete guide to rules file attacks →