How the detector works

Prompt Injection Check uses deterministic, explainable browser rules. The core function accepts plain text and returns structured findings; it does not call an AI model or upload scan content.

Covered categories

Instruction overrides, role hijacking, prompt extraction, data-exfiltration wording, fake delimiters, encoding/obfuscation, invisible Unicode, and hidden HTML content.

Interpretation

Results are warning signals, not a calibrated probability or a safety verdict. A finding includes a category, severity, matched span, explanation, and stable rule ID.

Structured result shape

This is an internal repository integration shape for the current scanText(text) function, not a public API or stability guarantee. Fields and rule identifiers may change as detector rules evolve. 

{
  "findings": [
    {
      "ruleId": "instruction-override.previous-instructions",
      "category": "instruction-override",
      "severity": "high",
      "start": 0,
      "end": 32,
      "matchedText": "Ignore all previous instructions",
      "explanation": "This passage asks an AI to discard instructions that came before it.",
      "sourceIds": ["owasp-llm01-2025"]
    }
  ],
  "score": 40,
  "grade": "D",
  "riskLevel": "high"
}

The score and grade are heuristic summaries for the site UI. They do not represent the probability that content is malicious.

Known limitations

Rules can miss paraphrased, multilingual, image-based, novel, or context-dependent attacks. Quoted documentation and legitimate role-play can produce false positives. Use least privilege, sandboxing, and human approval for consequential workflows.

Optional local semantic second stage

After the deterministic scan, users can explicitly load a same-origin quantized MiniLM ONNX model and run an English semantic-similarity check in a Web Worker. Inference uses WebGPU when supported and WASM otherwise. Text stays in the browser; the result is heuristic and never presented as proof of malicious intent.

Future npm/CLI shape

The detector is intentionally separated from the UI so it can later be imported as scanText(text) or exposed through a CLI without changing the website. No public API or package is published yet.

  1. Move the DOM-free detector, rule registry, types, and fixtures into a package entry point.
  2. Keep the JSON-compatible ScanResult shape and document versioning for rule IDs.
  3. Add a small command that reads a UTF-8 file, prints severity and rule IDs, and returns a non-zero status only when configured by the caller.
  4. Run the existing fixture suite in both browser and Node environments before publishing.

A future command could look like prompt-injection-check scan suspicious.txt and print findings, but this repository does not ship that command yet.

Review the synthetic detector benchmark →