Trust and authority, not a magic phrase
What is prompt injection?
Prompt injection is an attempt to make an AI system treat untrusted content as an instruction. The practical risk depends on where the content came from, what task the system is performing and what data or tools the system can reach. Detection can support review, but it cannot replace those boundary decisions.
Direct and indirect instructions
A direct injection is supplied by the person interacting with the AI system, for example a request to ignore a governing instruction or reveal hidden context. An indirect injection arrives inside material the system was asked to read: an email, retrieved page, support ticket, document excerpt or tool result can contain language directed at the model rather than at the human reader.
The words alone do not establish the trust role. A security article can quote the same sentence that an attacker might place in a retrieved page. A system prompt deliberately written by an authorized developer can also resemble a finding. That is why this scanner shows evidence, channel and context instead of treating a keyword as a verdict.
Why downstream authority changes the consequence
An AI chat with no tools has a different consequence surface from an agent that can read private records, send messages, purchase goods or modify files. The same instruction may be irrelevant in the first setting and consequential in the second. Least privilege, output validation and human approval for external actions remain necessary even when no indicator is reported.
Useful review asks two separate questions: does this source contain language that appears aimed at an AI system, and what could the receiving system do if it followed that language? This browser utility addresses the first question with deterministic rules. It does not inspect the receiving system or test whether a particular model would comply.
Direct, indirect and multimodal scope
Prompt injection can also appear in images, audio, rendered layout or another modality. Launch accepts plain text, supplied clipboard HTML and local UTF-8 text, Markdown and HTML files. It does not inspect image pixels, OCR, PDF, office documents, audio, video, archives or content fetched from a URL.
A complete result therefore means the declared channels for the selected input profile finished. It is not a statement about layers that were never supplied or formats the launch does not support. Coverage rows and limitations stay beside the outcome so that distinction survives beyond this page.
Primary references
These sources describe the external risks or standards discussed above. The property’s detector claims remain limited to its versioned policy and recorded evidence.