davila7/claude-code-templates · warning

SEM_W004

SEM_W004

Error message

Repetition instruction (potential prompt leakage)

What it means

SEM_W004 is a low-severity warning from checkSuspiciousPatterns when content matches /(repeat|echo)\s+after\s+me/gi. 'Repeat after me' phrasing is a classic prompt-leakage technique trying to make the model echo hidden system instructions or secrets. As a suspicious pattern it yields a warning normally and an error in strict mode.

Source

Thrown at cli-tool/src/validation/validators/SemanticValidator.js:105

        code: 'SEM_W001',
        message: 'Suspicious instruction: Role pretending detected',
        severity: 'medium'
      },
      {
        pattern: /\b(jailbreak|DAN|ChatGPT\s+Developer\s+Mode)\b/gi,
        code: 'SEM_W002',
        message: 'Known jailbreak terminology detected',
        severity: 'medium'
      },
      {
        pattern: /output\s+raw\s+(code|text|data)/gi,
        code: 'SEM_W003',
        message: 'Raw output request (potential data exfiltration)',
        severity: 'low'
      },
      {
        pattern: /(repeat|echo)\s+after\s+me/gi,
        code: 'SEM_W004',
        message: 'Repetition instruction (potential prompt leakage)',
        severity: 'low'
      }
    ];

    // Sensitive data patterns
    this.SENSITIVE_DATA_PATTERNS = [
      {
        pattern: /(?:password|passwd|pwd)\s*[:=]\s*[^\s]+/gi,
        code: 'SEM_E011',
        message: 'Hardcoded password detected',
        severity: 'critical'
      },
      {
        pattern: /(?:api[_-]?key|apikey)\s*[:=]\s*['"]?[a-zA-Z0-9]{20,}['"]?/gi,
        code: 'SEM_E012',
        message: 'Hardcoded API key detected',
        severity: 'critical'

View on GitHub (pinned to a0851ed10c)

Solutions

1. Reword the instruction, e.g. 'say the following phrase back' or 'recite the snippet'
2. For language-practice agents, use phrasing like 'read this sentence aloud'
3. Accept the warning (non-strict runs) if the usage is demonstrably benign

Example fix

# before
Repeat after me: const x = 42;
# after
Recite this line: const x = 42;

if (/(repeat|echo)\s+after\s+me/i.test(component.content)) {
  // reword to 'recite' / 'say back'

When it happens

Trigger: validate() on a component whose content string contains 'repeat after me' or 'echo after me' in any casing/spacing; escalated to an error when options.strict = true.

Common situations: Educational/tutoring agents that genuinely ask users to repeat phrases for practice, or markdown that documents social-engineering examples. Both are false positives that nonetheless trip the rule.

Related errors

• SEM_W003
• SEM_E011
• SEM_E014
• SEM_E016
• SEM_E017

AI-assisted analysis of davila7/claude-code-templates@a0851ed10c (2026-08-28). Data as JSON: /api/errors/6122af017295e911. Report an issue: GitHub.