Skip to main content
CXP’s output validator organizes detection rules into five categories. Each category describes a class of insecure behavior that a poisoned instruction file might trigger. When you run qai cxp validate, the validator checks captured assistant output against the detection rules for these categories. These categories also inform the built-in rule catalog — each catalog rule maps to one or more detection categories. 
qai cxp validate --result <ID>

​
Category Summary

IDNameOWASP LLM Top 10
backdoorBackdoor InsertionLLM01: Prompt Injection
exfilCredential ExfiltrationLLM01, LLM06: Excessive Agency
depconfusionDependency ConfusionLLM03: Supply Chain
permescalationPermission EscalationLLM01, LLM06: Excessive Agency
cmdexecCommand ExecutionLLM01, LLM06: Excessive Agency

​
backdoor — Backdoor Insertion

What the rule instructs: The poisoned instruction file tells the assistant to insert hardcoded credentials, bypass conditions, or hidden admin access into generated code. What it detects: Code containing hardcoded passwords, API keys, or authentication bypass logic (e.g. a default admin account that skips password checks). Related catalog rules: weak-crypto-md5, hardcoded-secrets OWASP mapping: LLM01 (Prompt Injection) — the instruction file acts as an indirect prompt injection that modifies the assistant’s code generation behavior.

​
exfil — Credential Exfiltration

What the rule instructs: The poisoned instruction file tells the assistant to add code that collects and transmits sensitive data — environment variables, tokens, config files — to an external endpoint. What it detects: Code that reads .env, credentials.json, or environment variables and sends them via HTTP request, DNS lookup, or log output to an external URL. Related catalog rules: outbound-exfil, hardcoded-secrets OWASP mapping: LLM01 (Prompt Injection), LLM06 (Excessive Agency) — the assistant both follows the injected instruction and takes an outbound network action beyond its expected scope.

​
depconfusion — Dependency Confusion

What the rule instructs: The poisoned instruction file tells the assistant to install packages from attacker-controlled registries or use typosquatted package names. What it detects: Generated requirements.txt, package.json, or install commands referencing packages from non-standard registries or typosquats of popular packages. Related catalog rules: extra-index-url OWASP mapping: LLM03 (Supply Chain) — the attack leverages the assistant to introduce malicious dependencies into the project’s supply chain.

​
permescalation — Permission Escalation

What the rule instructs: The poisoned instruction file tells the assistant to set overly permissive file modes, run processes with elevated privileges, or disable security controls. What it detects: Code that uses chmod 777, runs as root, disables SELinux/AppArmor, or grants overly broad IAM permissions. Related catalog rules: insecure-perms OWASP mapping: LLM01 (Prompt Injection), LLM06 (Excessive Agency) — the assistant modifies system security posture based on the injected instruction.

​
cmdexec — Command Execution

What the rule instructs: The poisoned instruction file tells the assistant to execute system commands via unsafe patterns such as os.system(), shell=True, or eval()/exec(). What it detects: Code containing direct shell command execution — subprocess.run(..., shell=True), os.system(user_input), or eval() with external data — creating code execution vectors. Related catalog rules: shell-true OWASP mapping: LLM01 (Prompt Injection), LLM06 (Excessive Agency) — the assistant introduces code execution primitives that an attacker can chain into RCE.