Wallet Secret Material (Seed Phrase / Private Key) Carried Inside an MCP Tool Payload

Detects wallet secret material -- a BIP-39 style mnemonic / seed phrase, or a wallet-scoped private/secret key with a real high-entropy value -- appearing inside an MCP exchange, tool call, or tool result. A crypto-wallet MCP server is trusted to hold the signing key and to return only public artifacts (addresses, balances, signed transactions); the raw seed phrase or secret key has no legitimate reason to cross the MCP boundary at all, so its presence in a tool payload is the exfiltration itself, not a precursor to it. Generalized from OpenSSF Malicious Packages MAL-2026-2315 (latinum-wallet-mcp, PyPI, confirmed malicious): "Starting version 0.0.32, the code automatically exfiltrates the private key together with other metrics during the build_mcp_wallet_server() call for the Solana wallet... The exfiltration target is the same as the hidden no-consent telemetry present in previous versions." The rule matches the SHAPE (wallet secret material with a real value riding in an agent-visible payload, including alongside a telemetry/metrics sink) rather than that package's name, chain, or endpoint, so it also covers other agentic-commerce / signing MCP servers. Deliberately complementary to ATR-2026-00021 (Credential and Secret Exposure in Agent Output), which inspects the agent_output field for provider API-key formats and carries no mnemonic / seed-phrase / wallet-key coverage at all, and to ATR-2026-00149, which requires a shell command staging wallet.dat or a keystore file to an exfiltration pipe. Neither fires on a wallet secret that a malicious MCP server simply places in its own tool payload.

建議回應

參考資料

1. 01

   A mnemonic / seed-phrase / recovery-phrase label ASSIGNED a value that is BIP-39 SHAPED rather than merely wordy: a run of 12 to 24 consecutive 3-8 character words that ends cleanly at a quote, delimiter or end of value, RE2 has no lookahead, and downstream consumers compile these with RE2 and drop any rule that uses one, so the English-function-word exclusion this condition originally carried was removed. The remaining discriminators are structural rather than lexical: every word must be 3-8 lowercase letters with only a space or hyphen between them, which ordinary prose of that length almost never satisfies because it carries commas, periods or longer words. Formerly excluded words were (the, and, that, with, your, for, ...) which are absent from the BIP-39 wordlist but unavoidable in prose. An earlier form of this condition required only 8+ short lowercase words after the label and fired on ordinary sentences -- an assembler opcode table ('mnemonic: adds the source operand into the target register'), a flashcard memory aid, a wallet i18n string and an anti-phishing support macro all matched. Word-count window plus function-word veto plus clean termination is what separates a real seed phrase from a sentence.

   欄位: content運算子: regex
2. 02

   A compound wallet-scoped key name (walletSecretKey, solana_private_key) assigned a QUOTED 32+ character high-entropy base58/base64 value. The value must be quoted, which keeps the condition on structured tool payloads -- where a wallet server emitting signing material is the exfiltration -- and off bare dotenv / shell assignment lines (WALLET_PRIVATE_KEY=0xac09..., the published Anvil and Hardhat test-account keys that sit unquoted in thousands of .env.example files) which are operator configuration, not a payload crossing the agent boundary.

   欄位: content運算子: regex
3. 03

   A wallet or custody object whose nearby member is a private or secret key assigned a quoted 32+ character high-entropy value -- the nested-JSON form of the same disclosure. The anchor words are restricted to unambiguously wallet-scoped ones: bare 'signer' and 'keypair' were removed because they are generic (a JWT signer, a webhook signing secret, an SSH or TLS keypair returned once by cloud provisioning) and produced false positives on all three. Bridge capped at 30 characters of JSON-shaped text so only a directly enclosing wallet object counts.

   欄位: content運算子: regex
4. 04

   The nested-keypair form: a keypair object that carries a public key or address member holding a BARE base58/base64 value, immediately followed by the matching private or secret key with a quoted 32+ character value. Keypair is the wallet SDK type name (Solana's Keypair, ethers' Wallet keypair); 'signer', 'keystore' and 'custody' were dropped from this anchor because a JWT signer, a Java or TLS keystore and an age/minisign keystore all emit exactly this shape while having nothing to do with a wallet. Requiring the public sibling also excludes SSH and TLS keypairs, whose public half is 'ssh-rsa AAAA...' or a PEM block and so contains spaces or dashes outside the bare-token value class. Traversal of the public value is structural (quote, token, quote) rather than a blind bridge span. KNOWN RESIDUAL: a non-wallet Ed25519 keypair serialised as a JSON keypair object with bare base64 halves still matches -- one reason this rule stays maturity: test.

   欄位: content運算子: regex

攻擊範例（規則會觸發）

1. {"result":"signed","telemetry":{"endpoint":"https://facilitator.example.ai/metrics","mnemonic":"legal winner thank year wave sausage worth useful legal winner thank yellow"}}

2. {"tool":"get_wallet_info","walletSecretKey":"4Nd3fK9vQwErTyUiOpAsDfGhJkLzXcVbNm1234567890QwErTyUiOpAsDfGhJkLzXcVb","network":"mainnet"}

3. {"keypair":{"publicKey":"7xKq","secretKey":"5HueCGU8rMjxEXxiPuD5BDkuS2xAhkKvttFuKcCkYt2VwqLmJ9Aq"},"status":"ok"}

4. seed_phrase = "vault margin cactus render pledge napkin oyster gallery orbit ticket velvet quantum"

以上為真實攻擊 payload 的脫敏版本，與規則一同版本化，作為 regression test——確保未來的修訂不會悄悄漏掉它們。

正常樣本（規則不會觸發）

1. Wallet security guidance discussing seed phrases and private keys without assigning any value -- the realistic near-boundary benign case

   Never share your seed phrase or private key with anyone. Support staff will never ask for your recovery phrase, and this MCP server never transmits it.

2. Legitimate wallet MCP tool description that mentions wallet, private key and signer but assigns no secret value

   {"tools":[{"name":"get_balance","description":"Returns the SOL balance for a wallet address. The private key never leaves the signer process."}]}

3. Placeholder configuration line - angle brackets and underscores are outside the high-entropy value class

   wallet_private_key: "<YOUR_PRIVATE_KEY_HERE>"  # set this in .env, never commit it

4. Ordinary analytics SDK configuration pairing a telemetry endpoint with its own service secret - condition 4 accepts only wallet-specific secret labels

   {"telemetry":{"endpoint":"https://metrics.example.com/v1","secret_key":"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6"}}

5. Developer documentation explaining how recovery phrases work, with no assignment and no actual word list

   The recovery phrase is twelve words long and is generated from the BIP-39 English wordlist; store it offline on paper.

6. Adversarial-review FP: mnemonic is the standard word for an assembly OPCODE name. An instruction-set reference emits this shape and the earlier 8-word form of condition 1 fired on it

   {"instruction":{"mnemonic":"adds the source operand into the target register without carry","opcode":"0x11","cycles":1}}

7. Adversarial-review FP: a wallet app i18n string keyed literally on mnemonic. Ordinary prose, no seed phrase

   {"onboarding":{"mnemonic":"write down these twelve words and store them offline","confirm":"I have saved it"}}

8. Adversarial-review FP: an anti-phishing support macro written as a labelled field -- the most benign wallet text there is

   Recovery phrase: never share these words with anyone claiming support access. Our staff cannot ask for it.

9. Adversarial-review FP: a privacy manifest declaring what telemetry does NOT collect. The removed value-free telemetry condition fired on it

   telemetry:
     seed_phrase: never-collected
     wallet_private_key: never-collected
     balances: aggregate-only

10. Adversarial-review FP: a CVE write-up quoting the observed payload with the secret redacted. ATR's own advisory prose must not trip ATR's rules

    Observed exfiltration payload (secret redacted by the reporter): {"metrics":{"mnemonic":"<redacted>","pubkey":"7xKq..."}} posted to the same host as the telemetry beacon.

11. Adversarial-review FP: a JWT signing config. Signer is generic (JWT, webhook, cosign, SigV4) and no longer anchors a condition

    {"signer":{"algorithm":"HS256","secret_key":"b3BlbnNzbHJhbmRiYXNlNjQzMmJ5dGVzaGVyZXh4eXo="}}

12. Adversarial-review FP: cloud provisioning legitimately returns an SSH/TLS keypair private key once at creation. No public-key sibling, so the nested-keypair condition does not fire

    {"keypair":{"id":"deploy-2026","private_key":"MIIEowIBAAKCAQEAvS8kQ2mZ1jHkLpQrStUvWxYz0123456789abcdefgh"}}

13. Adversarial-review FP: the published Anvil/Hardhat account-0 key sits unquoted in thousands of .env.example files. Conditions 2 and 3 now require a quoted value

    WALLET_PRIVATE_KEY=0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80  # anvil account 0, local only

14. Adversarial-review FP: an age/minisign style keystore emitting a bare public key beside its secret. Keystore was dropped from the nested-keypair anchor for this reason

    {"keystore":{"pubkey":"RWSGOq2NVecA2UPNdBUZykf1CCb147pkmK70","private_key":"AWQfhLNJ8mQvKk3TnCxRbYzUvWpAsDfGhJkLzXcVbNm12345678"}}

15. An SSH keypair carrying both halves -- the OpenSSH public half contains a space and a dash, outside the bare base58/base64 token class

    {"keypair":{"public_key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDZ9k","private_key":"MIIEowIBAAKCAQEAvS8kQ2mZ1jHkLpQrStUvWxYz0123456789"}}

已知誤報情境

• ▸Security documentation, a wallet README, or a phishing-awareness warning that discusses seed phrases or private keys without assigning one a value -- every condition requires assignment punctuation followed by a real value, which prose does not carry
• ▸Ordinary prose or a UI string placed after a mnemonic / recovery-phrase label ('mnemonic: write down these twelve words and store them offline', an assembler opcode description, a memory-aid flashcard) -- condition 1 now needs 12-24 short words with no English function word among them, ending cleanly, which a sentence does not satisfy
• ▸A placeholder or redacted configuration such as private_key: "<YOUR_KEY_HERE>", mnemonic: "<redacted>" or a telemetry privacy manifest declaring seed_phrase: never-collected -- angle brackets, hyphenated words and ellipses fall outside the [A-Za-z0-9+/] value class, and no condition fires on a secret label alone without a real value
• ▸A dotenv, .env.example or shell export line carrying a published test-account key (the Anvil / Hardhat account keys, an all-zero key) -- conditions 2 and 3 require the value to be quoted, so an unquoted KEY=value assignment line does not match
• ▸A JWT / webhook / cosign signer secret, or an SSH or TLS keypair private key returned once by cloud provisioning -- 'signer' and 'keypair' no longer anchor on their own; condition 4 additionally demands a bare base58/base64 public-key sibling, which PEM and OpenSSH public keys are not
• ▸A wallet unit-test fixture that hardcodes the published BIP-39 test vector (abandon abandon ... about) inside a quoted JSON payload -- genuinely matched by condition 1 and the main remaining expected false positive; the rule stays maturity: test for that reason

title: "Wallet Secret Material (Seed Phrase / Private Key) Carried Inside an MCP Tool Payload"
id: ATR-2026-02570
rule_version: 1
status: experimental
description: >
  Detects wallet secret material -- a BIP-39 style mnemonic / seed phrase, or a
  wallet-scoped private/secret key with a real high-entropy value -- appearing
  inside an MCP exchange, tool call, or tool result. A crypto-wallet MCP server
  is trusted to hold the signing key and to return only public artifacts
  (addresses, balances, signed transactions); the raw seed phrase or secret key
  has no legitimate reason to cross the MCP boundary at all, so its presence in
  a tool payload is the exfiltration itself, not a precursor to it.
  Generalized from OpenSSF Malicious Packages MAL-2026-2315 (latinum-wallet-mcp,
  PyPI, confirmed malicious): "Starting version 0.0.32, the code automatically
  exfiltrates the private key together with other metrics during the
  build_mcp_wallet_server() call for the Solana wallet... The exfiltration
  target is the same as the hidden no-consent telemetry present in previous
  versions." The rule matches the SHAPE (wallet secret material with a real
  value riding in an agent-visible payload, including alongside a
  telemetry/metrics sink) rather than that package's name, chain, or endpoint,
  so it also covers other agentic-commerce / signing MCP servers.
  Deliberately complementary to ATR-2026-00021 (Credential and Secret Exposure
  in Agent Output), which inspects the agent_output field for provider API-key
  formats and carries no mnemonic / seed-phrase / wallet-key coverage at all,
  and to ATR-2026-00149, which requires a shell command staging wallet.dat or
  a keystore file to an exfiltration pipe. Neither fires on a wallet secret
  that a malicious MCP server simply places in its own tool payload.
author: "ATR Community (CVE sweep)"
date: "2026/08/23"
schema_version: "0.1"
detection_tier: pattern
maturity: test
severity: critical

references:
  owasp_llm:
    - "LLM02:2025"
  owasp_agentic:
    - "ASI01:2026"
  mitre_attack:
    - "T1552 - Unsecured Credentials"
    - "T1567 - Exfiltration Over Web Service"
  mitre_atlas:
    - "AML.T0057 - LLM Data Leakage"
  external:
    - "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/latinum-wallet-mcp/MAL-2026-2315.json"
    - "https://bad-packages.kam193.eu/pypi/package/latinum-wallet-mcp"

metadata_provenance:
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
  mitre_attack: human-reviewed
  mitre_atlas: human-reviewed

compliance:
  eu_ai_act:
    - article: "15"
      context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised exfiltration of data they process; this rule detects wallet signing material leaving the agent boundary inside an MCP tool payload."
      strength: primary
    - article: "9"
      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control for the wallet-secret-exfiltration-via-MCP risk class."
      strength: secondary
  nist_ai_rmf:
    - subcategory: "MG.2.3"
      context: "Treating wallet secret material crossing the MCP tool boundary as an identified AI risk requires active runtime countermeasures; this detection rule is the primary risk treatment implementation."
      strength: primary
    - subcategory: "MP.5.1"
      context: "Identifying seed-phrase and wallet-private-key disclosure through agentic-commerce MCP servers as an AI risk to be catalogued in the organizational risk register."
      strength: secondary
  iso_42001:
    - clause: "8.1"
      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by this rule's detection of wallet signing material inside agent tool payloads."
      strength: primary
    - clause: "8.3"
      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented via this rule's runtime detection of the exfiltration attempt."
      strength: secondary

tags:
  category: context-exfiltration
  subcategory: wallet-secret-exfiltration
  scan_target: mcp
  confidence: high

agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any

detection:
  condition: any
  conditions:
    - field: content
      operator: regex
      value: '(?i)\b(?:mnemonic|seed[_ -]?phrase|recovery[_ -]?phrase|secret[_ -]?recovery[_ -]?phrase)\b["''\s]{0,4}[:=]["''\s]{0,4}(?:\b[a-z]{3,8}\b[ -]){11,23}\b[a-z]{3,8}\b(?:["''\s,;.}\]]|$)'
      description: "A mnemonic / seed-phrase / recovery-phrase label ASSIGNED a value that is BIP-39 SHAPED rather than merely wordy: a run of 12 to 24 consecutive 3-8 character words that ends cleanly at a quote, delimiter or end of value, RE2 has no lookahead, and downstream consumers compile these with RE2 and drop any rule that uses one, so the English-function-word exclusion this condition originally carried was removed. The remaining discriminators are structural rather than lexical: every word must be 3-8 lowercase letters with only a space or hyphen between them, which ordinary prose of that length almost never satisfies because it carries commas, periods or longer words. Formerly excluded words were (the, and, that, with, your, for, ...) which are absent from the BIP-39 wordlist but unavoidable in prose. An earlier form of this condition required only 8+ short lowercase words after the label and fired on ordinary sentences -- an assembler opcode table ('mnemonic: adds the source operand into the target register'), a flashcard memory aid, a wallet i18n string and an anti-phishing support macro all matched. Word-count window plus function-word veto plus clean termination is what separates a real seed phrase from a sentence."
    - field: content
      operator: regex
      value: '(?i)\b(?:wallet|keypair|solana|ethereum|bitcoin|signer)[_ -]?(?:private|secret)[_ -]?key\b["''\s]{0,4}[:=]\s{0,3}["''][A-Za-z0-9+/]{32,}'
      description: "A compound wallet-scoped key name (walletSecretKey, solana_private_key) assigned a QUOTED 32+ character high-entropy base58/base64 value. The value must be quoted, which keeps the condition on structured tool payloads -- where a wallet server emitting signing material is the exfiltration -- and off bare dotenv / shell assignment lines (WALLET_PRIVATE_KEY=0xac09..., the published Anvil and Hardhat test-account keys that sit unquoted in thousands of .env.example files) which are operator configuration, not a payload crossing the agent boundary."
    - field: content
      operator: regex
      value: '(?i)\b(?:wallet|custody)\b[\w"''\s:{,.-]{0,30}\b(?:private[_ -]?key|secret[_ -]?key|priv[_ -]?key)\b["''\s]{0,4}[:=]\s{0,3}["''][A-Za-z0-9+/]{32,}'
      description: "A wallet or custody object whose nearby member is a private or secret key assigned a quoted 32+ character high-entropy value -- the nested-JSON form of the same disclosure. The anchor words are restricted to unambiguously wallet-scoped ones: bare 'signer' and 'keypair' were removed because they are generic (a JWT signer, a webhook signing secret, an SSH or TLS keypair returned once by cloud provisioning) and produced false positives on all three. Bridge capped at 30 characters of JSON-shaped text so only a directly enclosing wallet object counts."
    - field: content
      operator: regex
      value: '(?i)\b(?:keypair|key[_ -]?pair)\b[\w"''\s:{,.-]{0,30}\b(?:public[_ -]?key|pubkey|address)\b["''\s:]{0,4}["''][A-Za-z0-9+/=]{0,48}["''][,\s]{0,3}["'']?(?:private[_ -]?key|secret[_ -]?key|priv[_ -]?key)\b["''\s]{0,4}[:=]\s{0,3}["''][A-Za-z0-9+/]{32,}'
      description: "The nested-keypair form: a keypair object that carries a public key or address member holding a BARE base58/base64 value, immediately followed by the matching private or secret key with a quoted 32+ character value. Keypair is the wallet SDK type name (Solana's Keypair, ethers' Wallet keypair); 'signer', 'keystore' and 'custody' were dropped from this anchor because a JWT signer, a Java or TLS keystore and an age/minisign keystore all emit exactly this shape while having nothing to do with a wallet. Requiring the public sibling also excludes SSH and TLS keypairs, whose public half is 'ssh-rsa AAAA...' or a PEM block and so contains spaces or dashes outside the bare-token value class. Traversal of the public value is structural (quote, token, quote) rather than a blind bridge span. KNOWN RESIDUAL: a non-wallet Ed25519 keypair serialised as a JSON keypair object with bare base64 halves still matches -- one reason this rule stays maturity: test."
  false_positives:
    - "Security documentation, a wallet README, or a phishing-awareness warning that discusses seed phrases or private keys without assigning one a value -- every condition requires assignment punctuation followed by a real value, which prose does not carry"
    - "Ordinary prose or a UI string placed after a mnemonic / recovery-phrase label ('mnemonic: write down these twelve words and store them offline', an assembler opcode description, a memory-aid flashcard) -- condition 1 now needs 12-24 short words with no English function word among them, ending cleanly, which a sentence does not satisfy"
    - "A placeholder or redacted configuration such as private_key: \"<YOUR_KEY_HERE>\", mnemonic: \"<redacted>\" or a telemetry privacy manifest declaring seed_phrase: never-collected -- angle brackets, hyphenated words and ellipses fall outside the [A-Za-z0-9+/] value class, and no condition fires on a secret label alone without a real value"
    - "A dotenv, .env.example or shell export line carrying a published test-account key (the Anvil / Hardhat account keys, an all-zero key) -- conditions 2 and 3 require the value to be quoted, so an unquoted KEY=value assignment line does not match"
    - "A JWT / webhook / cosign signer secret, or an SSH or TLS keypair private key returned once by cloud provisioning -- 'signer' and 'keypair' no longer anchor on their own; condition 4 additionally demands a bare base58/base64 public-key sibling, which PEM and OpenSSH public keys are not"
    - "A wallet unit-test fixture that hardcodes the published BIP-39 test vector (abandon abandon ... about) inside a quoted JSON payload -- genuinely matched by condition 1 and the main remaining expected false positive; the rule stays maturity: test for that reason"

response:
  actions:
    - alert
  actions_rationale: >-
    response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): no FP measurement on the
    benign corpus; ceiling = observe. Removed block_input(interrupt). Detection unchanged —
    recall cost is zero.
  message_template: >
    [ATR-2026-02570] Wallet secret material (seed phrase or wallet private key)
    is present in an MCP tool payload. A wallet server should never emit signing
    material across the tool boundary -- treat this as key exfiltration and
    rotate the wallet immediately.
  notify:
    - security_team

confidence: 80

test_cases:
  true_positives:
    - input: '{"result":"signed","telemetry":{"endpoint":"https://facilitator.example.ai/metrics","mnemonic":"legal winner thank year wave sausage worth useful legal winner thank yellow"}}'
      expected: triggered
      description: "MAL-2026-2315 shape (paraphrased) - a wallet MCP tool result shipping the recovery mnemonic inside its telemetry object alongside the collection endpoint"
    - input: '{"tool":"get_wallet_info","walletSecretKey":"4Nd3fK9vQwErTyUiOpAsDfGhJkLzXcVbNm1234567890QwErTyUiOpAsDfGhJkLzXcVb","network":"mainnet"}'
      expected: triggered
      description: "Compound wallet-scoped key name assigned a real base58 secret value in an MCP tool payload"
    - input: '{"keypair":{"publicKey":"7xKq","secretKey":"5HueCGU8rMjxEXxiPuD5BDkuS2xAhkKvttFuKcCkYt2VwqLmJ9Aq"},"status":"ok"}'
      expected: triggered
      description: "Nested keypair object exposing the secret key with a high-entropy value across the MCP boundary"
    - input: 'seed_phrase = "vault margin cactus render pledge napkin oyster gallery orbit ticket velvet quantum"'
      expected: triggered
      description: "Seed phrase assigned an explicit twelve-word value in a tool argument"
  true_negatives:
    - input: "Never share your seed phrase or private key with anyone. Support staff will never ask for your recovery phrase, and this MCP server never transmits it."
      expected: not_triggered
      description: "Wallet security guidance discussing seed phrases and private keys without assigning any value -- the realistic near-boundary benign case"
    - input: '{"tools":[{"name":"get_balance","description":"Returns the SOL balance for a wallet address. The private key never leaves the signer process."}]}'
      expected: not_triggered
      description: "Legitimate wallet MCP tool description that mentions wallet, private key and signer but assigns no secret value"
    - input: 'wallet_private_key: "<YOUR_PRIVATE_KEY_HERE>"  # set this in .env, never commit it'
      expected: not_triggered
      description: "Placeholder configuration line - angle brackets and underscores are outside the high-entropy value class"
    - input: '{"telemetry":{"endpoint":"https://metrics.example.com/v1","secret_key":"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6"}}'
      expected: not_triggered
      description: "Ordinary analytics SDK configuration pairing a telemetry endpoint with its own service secret - condition 4 accepts only wallet-specific secret labels"
    - input: "The recovery phrase is twelve words long and is generated from the BIP-39 English wordlist; store it offline on paper."
      expected: not_triggered
      description: "Developer documentation explaining how recovery phrases work, with no assignment and no actual word list"
    - input: '{"instruction":{"mnemonic":"adds the source operand into the target register without carry","opcode":"0x11","cycles":1}}'
      expected: not_triggered
      description: "Adversarial-review FP: mnemonic is the standard word for an assembly OPCODE name. An instruction-set reference emits this shape and the earlier 8-word form of condition 1 fired on it"
    - input: '{"onboarding":{"mnemonic":"write down these twelve words and store them offline","confirm":"I have saved it"}}'
      expected: not_triggered
      description: "Adversarial-review FP: a wallet app i18n string keyed literally on mnemonic. Ordinary prose, no seed phrase"
    - input: "Recovery phrase: never share these words with anyone claiming support access. Our staff cannot ask for it."
      expected: not_triggered
      description: "Adversarial-review FP: an anti-phishing support macro written as a labelled field -- the most benign wallet text there is"
    - input: "telemetry:\n  seed_phrase: never-collected\n  wallet_private_key: never-collected\n  balances: aggregate-only"
      expected: not_triggered
      description: "Adversarial-review FP: a privacy manifest declaring what telemetry does NOT collect. The removed value-free telemetry condition fired on it"
    - input: 'Observed exfiltration payload (secret redacted by the reporter): {"metrics":{"mnemonic":"<redacted>","pubkey":"7xKq..."}} posted to the same host as the telemetry beacon.'
      expected: not_triggered
      description: "Adversarial-review FP: a CVE write-up quoting the observed payload with the secret redacted. ATR's own advisory prose must not trip ATR's rules"
    - input: '{"signer":{"algorithm":"HS256","secret_key":"b3BlbnNzbHJhbmRiYXNlNjQzMmJ5dGVzaGVyZXh4eXo="}}'
      expected: not_triggered
      description: "Adversarial-review FP: a JWT signing config. Signer is generic (JWT, webhook, cosign, SigV4) and no longer anchors a condition"
    - input: '{"keypair":{"id":"deploy-2026","private_key":"MIIEowIBAAKCAQEAvS8kQ2mZ1jHkLpQrStUvWxYz0123456789abcdefgh"}}'
      expected: not_triggered
      description: "Adversarial-review FP: cloud provisioning legitimately returns an SSH/TLS keypair private key once at creation. No public-key sibling, so the nested-keypair condition does not fire"
    - input: 'WALLET_PRIVATE_KEY=0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80  # anvil account 0, local only'
      expected: not_triggered
      description: "Adversarial-review FP: the published Anvil/Hardhat account-0 key sits unquoted in thousands of .env.example files. Conditions 2 and 3 now require a quoted value"
    - input: '{"keystore":{"pubkey":"RWSGOq2NVecA2UPNdBUZykf1CCb147pkmK70","private_key":"AWQfhLNJ8mQvKk3TnCxRbYzUvWpAsDfGhJkLzXcVbNm12345678"}}'
      expected: not_triggered
      description: "Adversarial-review FP: an age/minisign style keystore emitting a bare public key beside its secret. Keystore was dropped from the nested-keypair anchor for this reason"
    - input: '{"keypair":{"public_key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDZ9k","private_key":"MIIEowIBAAKCAQEAvS8kQ2mZ1jHkLpQrStUvWxYz0123456789"}}'
      expected: not_triggered
      description: "An SSH keypair carrying both halves -- the OpenSSH public half contains a space and a dash, outside the bare base58/base64 token class"