Prompt Injection Scanner

What this scanner looks for

The scanner checks for common prompt injection patterns: instructions to ignore previous rules, claims of system or developer authority, requests to reveal secrets, hidden HTML/CSS text, encoded-looking blobs and attempts to redirect an agent's task.

How to use the result

A finding does not prove the content is malicious. Treat it as a review queue: inspect the highlighted lines, remove untrusted instructions, and keep AI agents constrained to the user's explicit task.

Frequently asked questions

Can this guarantee safe AI agent browsing?

No. Prompt injection is contextual. Use this as a quick preflight check alongside tool permissions, allowlists, sandboxing and human review for sensitive actions.

Should I scan web pages before summarizing them?

For casual summaries, probably not. For agent workflows that can send email, write files, access private data or spend money, scanning untrusted content is a sensible guardrail.

Does the scan leave my browser?

No. The scanner runs locally in JavaScript and does not upload your pasted content.