hermes - 💡(How to fix) Fix Context-file scanner misses multi-word prompt injection variants

Summary

The context-file prompt-injection scanner in agent/prompt_builder.py::_scan_context_content misses multi-word variants of several blocked phrases. For example, ignore previous instructions is blocked, but variants such as ignore all prior instructions, ignore my previous instructions, and ignore any and all instructions are not.

Context files such as AGENTS.md, CLAUDE.md, .cursorrules, .cursor/rules/*.mdc, .hermes.md, HERMES.md, and SOUL.md are auto-loaded into the system prompt. A poisoned repository can therefore place bypass text in one of these files and have it included in the first LLM request when a user starts Hermes in that directory.

Impact

This is an indirect prompt-injection scanner bypass. A malicious repository can inject instructions into the project-context block that the model is told to follow, potentially steering tool use such as terminal commands, file writes, patches, memory writes, or delegated tasks.

Affected area

• agent/prompt_builder.py::_CONTEXT_THREAT_PATTERNS
• agent/prompt_builder.py::_scan_context_content
• context file loaders that call _scan_context_content() before appending project context

Suggested fix

Harden the duplicated scanner patterns to tolerate filler words in the same way as the already-hardened sibling scanner in tools/skills_guard.py, and add regression tests for multi-word prompt-injection, deception-hide, and disregard-rule variants.