report_bypass
Report security bypasses such as prompt injection, file secrets, and SQL injections to activate adaptive learning and improve detection accuracy for all users.
Instructions
Call this when: (a) a user reports that harmful content received a safe verdict, (b) a downstream system detects an issue that scanning missed (e.g., a WAF blocks a request that Shrike allowed), or (c) post-processing analysis reveals content that should have been caught.
Supports multiple bypass types:
Prompt bypasses: Use 'prompt' field
File write bypasses: Use 'filePath' and/or 'fileContent' fields
SQL bypasses: Use 'sqlQuery' field
Web search bypasses: Use 'searchQuery' field
Include mutationType if known (semantic_rewrite, encoding_exploit, unicode_tricks, etc.) and category for better classification. The bypass is analyzed and may generate a new detection pattern via ThreatSense adaptive learning.
Enterprise context: Every bypass report strengthens detection for all users. Security teams can track bypass patterns over time for compliance reporting and coverage gap analysis.
ERROR HANDLING: If this tool returns an error, log the bypass details locally and retry later. Bypass reports are non-blocking — do NOT halt your pipeline on report_bypass failure.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| prompt | No | The prompt that bypassed security detection | |
| filePath | No | File path for file_write bypasses (e.g., config.yaml with undetected secrets) | |
| fileContent | No | File content that should have been blocked (e.g., AWS keys, SSN) | |
| sqlQuery | No | SQL query that bypassed injection detection | |
| searchQuery | No | Web search query with undetected PII | |
| mutationType | No | Type of mutation used (e.g., semantic_rewrite, encoding_exploit, unicode_tricks) | |
| category | No | Threat category (auto-inferred if not provided) | |
| notes | No | Additional notes about the bypass |