Potential Prompt Injection Scanner
Review untrusted text for static instruction and Unicode signals locally, with explicit false-positive and bypass limitations.
Static heuristic analysis for potentially suspicious instructions in untrusted content.
This scanner uses static heuristics. It can identify suspicious patterns, but it cannot prove that content is safe or detect every prompt-injection technique.
32 KiB UTF-8. Paste retrieved documents, web text, tool outputs, email or other untrusted text. Content is inspected literally; HTML stays text. No decoding, tool execution or external analysis occurs.
Ready. Paste untrusted content to inspect.
Severity is a rule label, not a probability. Observed risk is the highest matching severity. English instruction patterns and character inspection are incomplete: quoted security documentation and legitimate formatting can trigger findings, and attackers can bypass static patterns. No finding establishes intent. Locations refer to the original text using zero-based UTF-16 offsets and one-based lines/columns (LF line boundaries). Previews are shortened and control characters escaped.
Enable JavaScript to scan locally.
Review untrusted instructions.
Static rules flag instruction overrides, prompt or credential extraction requests, exfiltration language, concrete tool-action coercion, authority claims, encoded-looking blocks and boundary markers. Character inspection separately shows invisible and bidirectional controls in escaped form. Actual secrets are not identified.
Findings are review cues.
Quoted security articles can match the same phrases as hostile content. Legitimate text and languages may use invisible characters. English phrase rules do not cover every language, spelling, encoding or adversarial technique. Absence of findings is not evidence of safety. The highest matched rule severity sets observed risk, without certainty percentages.
Apply controls outside the model.
Treat external text as data, keep trusted instructions separate, restrict tools and destinations, and validate arguments and outputs independently. Require confirmation for sensitive actions and keep credentials out of model context. No single mitigation eliminates prompt injection.
Bounded local inspection.
Inputs are capped at 32 KiB UTF-8. Fixed rules use bounded spans; users cannot supply regex. At most 100 findings are displayed, with truncation disclosed. Content is never decoded, executed, rendered as HTML or sent elsewhere.