Browser-local, bounded and inert
How the prompt injection scanner works
The scan is one deterministic worker run over an immutable acquisition snapshot. Source text has no authority: it is never rendered as submitted HTML or Markdown, supplied to a model, interpreted as configuration, or given a tool.
1. Select one input profile
Typed text, a plain clipboard paste, a rich clipboard paste and each supported local file type have separate declared profiles. Rich paste keeps the plain and HTML representations from the same event. Editing after that paste discards the stored HTML representation and changes the pending profile to typed text, preventing stale structure from being reported as inspected.
Local files are read as bytes, capped at 128 KiB, decoded as strict UTF-8 and selected by a supported declared MIME type before extension fallback. A filename is used only for that bounded fallback and is not sent to the worker result, report, log or URL.
2. Extract provenance-preserving channels
Plain text remains one channel. Pinned Core Documents drivers tokenize HTML and CommonMark inside the dedicated worker and return separated visible, hidden, comment, attribute, link, code and raw-HTML channels with locators. They do not insert source into a browser DOM or request submitted resources.
Each channel retains original positions. Versioned Core Text views can reveal controls, fold case, normalize for comparison or form a confusable skeleton while preserving mappings back to the admitted representation. A detector that cannot produce a bounded original span fails its layer instead of emitting vague evidence.
3. Run deterministic detector families
Structural rules inspect channel relationships, HTML placement, Unicode obfuscation, encoded candidates and cross-block fragmentation. Lexical rules require concept groups and proximity rather than a bare keyword. Context rules examine quotation, code, research framing, prohibitions, reported speech and whether language appears directed at a person.
Equivalent evidence across plain and rich clipboard representations is deduplicated. Moderate indicators can become one stronger finding only through a closed agreement rule using different detector families and a bounded evidence union. No private model, remote classifier or hidden numeric score participates.
4. Show outcome, coverage and next action
A validated completed result reports likely indicators, review-needed indicators, no indicators in the inspected text, or an incomplete scan. Status and completeness remain separate from that outcome. A positive finding can coexist with partial coverage, but the qualification must say that more supplied content may be uninspected.
Coverage appears before findings. Each finding includes an inert visible excerpt, original locator, category, rationale, detector references and conservative action. Text and JSON report controls are offered only when Core validates the completed result and the bounded export fits its ceiling.
Primary references
These sources describe the external risks or standards discussed above. The property’s detector claims remain limited to its versioned policy and recorded evidence.