{"record":{"id":"cb94de1968b041d8","repo":"NousResearch/hermes-agent","slug":"prompt-injection-scan-error","errorCode":null,"errorMessage":"{prompt injection scan error}","messagePattern":"\\{prompt injection scan error\\}","errorType":"exception","errorClass":"CronPromptInjectionBlocked","httpStatus":null,"severity":"error","filePath":"cron/scheduler.py","lineNumber":3156,"sourceCode":"        # strings. Invisible unicode is sanitized (not blocked) so a stray\n        # zero-width space can't permanently kill the job; the cleaned\n        # prompt is what actually runs.\n        cleaned, scan_error = _scan_cron_skill_assembled(assembled)\n        assembled = cleaned\n        if not scan_error and not has_skills and user_prompt:\n            # Data-injection path: keep the strict guarantee on the\n            # user-authored prompt itself.\n            scan_error = _scan_cron_prompt(user_prompt)\n    else:\n        scan_error = _scan_cron_prompt(assembled)\n    if scan_error:\n        job_label = job.get(\"name\") or job.get(\"id\") or \"<unknown>\"\n        logger.warning(\n            \"Cron job '%s': assembled prompt blocked by injection scanner — %s\",\n            job_label,\n            scan_error,\n        )\n        raise CronPromptInjectionBlocked(scan_error)\n    return assembled\n\n\ndef _guard_job_credential_exfil(job: dict) -> None:\n    \"\"\"Fail closed if a job's stored provider/base_url pair would exfiltrate a\n    credential (F8 runtime backstop; CWE-200/CWE-522).\n\n    The model-callable cron tool validates this on create/update, but a job\n    persisted before that guard — or written directly to the jobs store —\n    reaches the scheduler's provider-resolution sink unchecked. Re-validate the\n    EFFECTIVE stored pair with the same guard the tool uses, so a named\n    provider's stored key is never paired with an off-host base_url at fire\n    time. Raises ``RuntimeError`` (caught by the run_job failure path → the run\n    is aborted and reported) when the pair is unsafe; returns ``None`` otherwise.\n\n    Fallback providers come from operator config, not the model-callable job, so\n    they are trusted and validated by the caller, not here.\n    \"\"\"","sourceCodeStart":3138,"sourceCodeEnd":3174,"githubUrl":"https://github.com/NousResearch/hermes-agent/blob/c896c09c42910c584c4c7d2325b58c14713ea42c/cron/scheduler.py#L3138-L3174","documentation":"Error \"{prompt injection scan error}\" thrown in NousResearch/hermes-agent.","triggerScenarios":"Thrown at cron/scheduler.py:3156 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Review the prompt-injection scan error and the job content that triggered it.","Rephrase or remove the flagged content in the cron job prompt/script."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"c896c09c42910c584c4c7d2325b58c14713ea42c","analyzedAt":"2026-08-14T17:18:01.089Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}