How to read model-output red flags

Check the answer before you reuse it

People spend their review time on the prompt and then paste the completion into a ticket, a log, a customer email, or the next agent’s context. That second paste is where a private prompt becomes public and where a made-up key becomes a value someone might trust. The model-output red-flag checker is a local pass over that text. It quotes the line. It does not decide whether the answer is true, kind, legal, or on-policy.

The checker is the wrong tool for “is this medical advice good?” except for two narrow phrases described below. It is the wrong tool for bias, copyright, and factual accuracy. It is the right tool when you are about to store or forward a completion and you want a mechanical look for secrets, echoed instructions, and a handful of high-cost phrases.

If you are about to feed the completion into another model or another tool, run this checker and also think about the injection scanner. Output that says “ignore previous instructions” is untrusted data with a payload aimed at the next reader. OWASP’s prompt-injection write-up covers that handoff as one of the ways indirect injection spreads. This site’s version of the warning is the quote the checker shows you.

Secrets and identifiers

These rules exist so a completion does not get copied into a place where a credential or a personal number will spread. They are shapes, not lookups against a bank or a key database. A match means “look at this before you share it.”

• Possible API key or token. Strings shaped like common live credentials, including an sk- prefix followed by a long token, an AWS-style access key prefix, common GitHub and Slack token prefixes, a Google API key prefix, and a long bearer token. Example keys in tutorials match. If the key was real, rotate it. If it was a documented fake, the finding is still useful: it shows the completion is carrying credential-shaped text into whatever system stores the answer.
• Assigned secret. A line that assigns api key, secret, password, or token to a value of eight or more characters. Fixtures and sample config match. So does a real password the model repeated from the prompt.
• Possible US Social Security number. The shape ###-##-####. Order numbers and other identifiers with that shape match. The checker does not know whether the number was issued. If it is a real number, remove it before the output is stored or shown.
• Possible payment card number. A common card-length grouping. This is not a Luhn check and not a call to a payment network. Confirm the digits before you keep the output.
• Several email addresses. Three or more addresses in one paste. A single address in a normal reply is ignored. A signature block plus a cc list can cross the line. The weight is low. It is a prompt to notice a contact list, not a breach declaration.

Instructions hiding in the answer

The next group is about the completion telling someone, or some tool, what to do.

• Echoed system prompt. The completion talks about its system prompt, hidden instructions, or developer message, or says “my instructions say.” Models sometimes describe their behavior in those words without quoting a secret prompt. They also sometimes quote the real prompt. The quote on the result is the difference. If you see your private prompt in the quote, treat the completion as a disclosure: do not file it in a public ticket.
• Injection aimed at the next step. “Ignore previous instructions” and close variants. Critical, because the next agent may obey it. A completion that warns a user by quoting the phrase will also match. You are reading a quote of a quote. Keep it out of the next tool’s instruction channel anyway.
• Tool or chat delimiter. Control tokens and system, assistant, or tool tags inside the answer. Strip them before the text is concatenated into another prompt. Left in place, they can change how a later parser assigns roles.
• Refusal followed by steps. A refusal such as “I can’t” or “I’m not able to,” followed within a short window by “step 1,” “here’s how,” or “follow these steps.” A model that refuses and then gives the harmful steps is the case the rule was written for. A model that refuses and then says “here’s how to reset your password instead” matches too. Read the whole answer. The first sentence is not a guarantee, and the match is not a guarantee either.
• Request for a password or account code. “Enter,” “type,” “provide,” or “send” near password, one-time code, OTP, or Social Security number. A phishing-like completion matches. So does the safer sentence “enter your password on the bank’s site, not in this chat,” because the rule does not model negation. The quote shows you which sentence you have.
• Unsafe medical instruction. “Stop taking” near medication, medicine, meds, or prescription, or the phrase “guaranteed cure” or “guaranteed treatment.” “Do not stop taking your prescribed medication” matches, because the words “stop taking” and “medication” sit inside the window. This checker is not a medical device. A clinician reviews health advice. The rule only stops a careless paste from being auto-forwarded when those words appear.
• Hidden or bidirectional characters. The same invisible-Unicode check as the injection scanner. Strip those characters before the completion is displayed or forwarded. They can make two viewers disagree about the text.

The built-in example is deliberately noisy

The checker ships with an example that refuses, continues with “here’s how,” mentions a system prompt, includes an sk- style key, and includes a ###-##-#### number. It is supposed to fire several rules at once, and the summed weights hit the 100-point cap. That cap is a reading aid. It is not a measurement of how bad a real incident was.

Use the example to see quotes, then clear it. Do not add a real customer key to “see what happens.” If a real key is already on your screen, the right next step is to revoke it, not to score it. The privacy policy explains why an ad-supported page is a poor place to handle live secrets. Running the check does not upload the box. Storing the paste is a separate opt-in after you sign in.

What a clean completion still needs

A clear result means these shapes were absent from the scanned characters. The completion can still be wrong, rude, copied from a copyrighted source, or unsafe in a way this list does not encode. It can still be too long: only the first 20,000 characters are scanned, and the cutoff itself adds a low-severity finding, so a very long answer is never fully clear.

Before you store the text, decide the audience. A customer should not receive another customer’s number. A public issue tracker should not receive a system prompt. A downstream agent should not receive control tokens. Those are handling rules. The checker is a flashlight for a few of them.

If the completion will trigger an action, a person should see the action when it can spend money, send a message, or change an account. The score does not replace that person. The heuristic-check guide describes a short workflow that keeps the score in its lane.

Further reading

Secret handling is ordinary security practice: if a credential appeared in a place you do not control, revoke it and issue another. Prompt injection via model output is the same class of problem as injection via a web page, which OWASP documents under LLM01:2025. This checker does not claim to implement that entire control list. It implements the patterns in the bullets above.

Open OWASP LLM01:2025 for the broader risk, then the output checker for the rule list you can run on text you already have.