davila7/claude-code-templates · critical

SEM_E007

SEM_E007

Error message

Security bypass attempt detected

What it means

SEM_E007 is a critical finding matching /(disable|bypass|override|skip)\s+(security|safety|filter|protection|validation)/gi. It catches instructions telling the agent to turn off its own safeguards — a direct jailbreak technique. SemanticValidator emits it during content validation whenever this verb+target pairing occurs.

Source

Thrown at cli-tool/src/validation/validators/SemanticValidator.js:59

        code: 'SEM_E004',
        message: 'Command execution attempt detected',
        severity: 'critical'
      },
      {
        pattern: /\b(fetch|retrieve|get|extract|obtain|steal|harvest|capture|collect)\s+(the\s+)?(user['']?s?\s+)?(auth\s+)?(token|key|password|credential|secret|api[\s_-]?key)/gi,
        code: 'SEM_E005',
        message: 'Credential harvesting pattern detected',
        severity: 'critical'
      },
      {
        pattern: /(open|spawn|exec|run)\s+(a\s+)?(shell|terminal|bash|cmd|powershell)/gi,
        code: 'SEM_E006',
        message: 'Shell access attempt detected',
        severity: 'critical'
      },
      {
        pattern: /(disable|bypass|override|skip)\s+(security|safety|filter|protection|validation)/gi,
        code: 'SEM_E007',
        message: 'Security bypass attempt detected',
        severity: 'critical'
      },
      {
        pattern: /always\s+(obey|follow|comply\s+with|execute)\s+the\s+user/gi,
        code: 'SEM_E008',
        message: 'Unconditional obedience instruction detected',
        severity: 'high'
      },
      {
        pattern: /(forget|disregard|remove)\s+(everything|all\s+previous|prior\s+context)/gi,
        code: 'SEM_E009',
        message: 'Context manipulation attempt detected',
        severity: 'high'
      },
      {
        pattern: /modify\s+your\s+(own\s+)?(code|behavior|instructions?|rules?)/gi,
        code: 'SEM_E010',

View on GitHub (pinned to a0851ed10c)

Solutions

1. Rephrase CI advice to avoid the exact pairing: 'validation can be loosened in development via config' instead of 'skip validation'
2. Keep quoted attack samples out of validated content fields, or paraphrase them
3. Scope instructions to specific named tools: 'run eslint with --rule warnings' rather than 'disable the filter'
4. Use the review waiver if the component is a verified security-testing artifact

Example fix

// before
Skip validation when deploying to the dev environment.

// after
Use the `--no-verify` deploy profile for development environments after review.

const BYPASS_RE = /(disable|bypass|override|skip)\s+(security|safety|filter|protection|validation)/i;
function containsBypassLanguage(text) { return BYPASS_RE.test(text); }

function isSafeBypassText(text) { return !/(disable|bypass|override|skip)\s+(security|safety|filter|protection|validation)/i.test(text); }

When it happens

Trigger: Component text containing phrases like 'bypass security checks', 'skip validation', 'disable safety filters', 'override protection' (any casing, flexible whitespace). Often appears inside red-team/testing components or when authors quote injection payloads.

Common situations: Security-research or red-team agents that describe attack techniques; CI components that legitimately suggest skipping lint/validation steps ('skip validation in dev mode'); docs quoting jailbreak attempts for educational purposes.

Related errors

• SEM_E008
• SEM_E009
• SEM_E010
• SEM_W002
• SEM_E003

AI-assisted analysis of davila7/claude-code-templates@a0851ed10c (2026-08-28). Data as JSON: /api/errors/52680ef03ce94c39. Report an issue: GitHub.