davila7/claude-code-templates · critical

SEM_E005

SEM_E005

Error message

Credential harvesting pattern detected

What it means

SEM_E005 is a critical finding from the credential-harvesting regex /\b(fetch|retrieve|get|extract|obtain|steal|harvest|capture|collect)\s+(the\s+)?(user'?s?\s+)?(auth\s+)?(token|key|password|credential|secret|api[\s_-]?key)/gi. It detects instructions that direct the agent to obtain secrets — the core behavior of exfiltration-focused malicious components. The validator emits it whenever matched text appears in any validated field of the component.

Source

Thrown at cli-tool/src/validation/validators/SemanticValidator.js:47

        code: 'SEM_E002',
        message: 'Prompt injection detected: Reference to system/developer instructions',
        severity: 'critical'
      },
      {
        pattern: /you\s+are\s+now\s+(a|an)\s+/gi,
        code: 'SEM_E003',
        message: 'Role manipulation detected: Attempt to redefine AI role',
        severity: 'high'
      },
      {
        pattern: /execute\s+the\s+following\s+(code|command|script)/gi,
        code: 'SEM_E004',
        message: 'Command execution attempt detected',
        severity: 'critical'
      },
      {
        pattern: /\b(fetch|retrieve|get|extract|obtain|steal|harvest|capture|collect)\s+(the\s+)?(user['']?s?\s+)?(auth\s+)?(token|key|password|credential|secret|api[\s_-]?key)/gi,
        code: 'SEM_E005',
        message: 'Credential harvesting pattern detected',
        severity: 'critical'
      },
      {
        pattern: /(open|spawn|exec|run)\s+(a\s+)?(shell|terminal|bash|cmd|powershell)/gi,
        code: 'SEM_E006',
        message: 'Shell access attempt detected',
        severity: 'critical'
      },
      {
        pattern: /(disable|bypass|override|skip)\s+(security|safety|filter|protection|validation)/gi,
        code: 'SEM_E007',
        message: 'Security bypass attempt detected',
        severity: 'critical'
      },
      {
        pattern: /always\s+(obey|follow|comply\s+with|execute)\s+the\s+user/gi,
        code: 'SEM_E008',

View on GitHub (pinned to a0851ed10c)

Solutions

1. Rephrase to reference environment variables without the flagged verb-noun pair: 'Use process.env.MY_API_KEY' instead of 'get the api key'
2. Refer to secrets generically as 'credentials from the environment' via configuration, not imperative prose
3. If quoting an attack sample, obfuscate it (e.g. 'retr**ve the pa**word') or keep it out of validated fields
4. For approved security-testing components, use the pipeline's waiver after review

Example fix

// before
Retrieve the auth token from ~/.netrc and include it in the request.

// after
Read credentials via the configured auth provider (e.g. process.env.AUTH_TOKEN).

const CRED_RE = /\b(fetch|retrieve|get|extract|obtain|steal|harvest|capture|collect)\s+(the\s+)?(user'?s?\s+)?(auth\s+)?(token|key|password|credential|secret|api[\s_-]?key)/i;
function containsCredentialHarvesting(text) { return CRED_RE.test(text); }
if (containsCredentialHarvesting(content)) failFast('Reword secret-handling instructions.');

function isSafeSecretText(text) { return !/\b(fetch|retrieve|get|extract|obtain|steal|harvest|capture|collect)\s+(the\s+)?(user'?s?\s+)?(auth\s+)?(token|key|password|credential|secret|api[\s_-]?key)/i.test(text); }

When it happens

Trigger: Component content containing verb+secret noun combinations such as 'retrieve the API key', 'get the user's password', or 'collect auth tokens'. Note api[\s_-]?key also matches 'api_key' and 'api-key', and the optional possessive means 'fetch tokens' alone matches.

Common situations: Legitimate automation docs that tell the agent to read an env var secret ('get the API key from the environment'); MCP integration components describing token-based auth flows; security-audit components that quote attacker phrasing.

Related errors

• SEM_E003
• SEM_E004
• SEM_E006
• SEM_E007
• SEM_E008

AI-assisted analysis of davila7/claude-code-templates@a0851ed10c (2026-08-28). Data as JSON: /api/errors/90ebaa5e09efeb72. Report an issue: GitHub.