Injectshield — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Injectshield (Agent Skill) and scored it 65/100 (yellow). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 4 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 6 flagged
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.The text {match} asks the agent to disclose its hidden system prompt or initial instructions. That is often the first step of a larger attack: knowing the system prompt lets an attacker craft inputs that defeat its constraints by mimicking its own voice.
repeat/reveal/print your system prompt request from the skill.The text {match} asks the agent to disclose its hidden system prompt or initial instructions. That is often the first step of a larger attack: knowing the system prompt lets an attacker craft inputs that defeat its constraints by mimicking its own voice.
repeat/reveal/print your system prompt request from the skill.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Prompt-injection firewall for AI agents.
A drop-in REST API that detects and neutralizes injection attacks in any text — git commits, web pages, files, emails, user inputs — before they reach your AI agent's context window.
This repo is the open-source heuristic ruleset plus the source for the managed API at promptshield.pages.dev.
In May 2026 a viral HN thread demonstrated that a single git commit message could burn a Claude Code user's entire session quota via a schema-driven attack ("OpenClaw"). The pattern is general: any AI agent that ingests untrusted text — code review bots, documentation summarizers, RAG agents, support copilots — is exposed to prompt injection. Most teams ship without any input-side defense.
InjectShield is one layer of a defense-in-depth strategy. It's not a silver bullet. Use it alongside system-prompt hardening, tool sandboxing, and output filtering.
InjectShield ships a native MCP server at @injectshield/mcp. Once installed, your agent has three new tools — scan, scan_url, patterns — for input-side defense without writing any glue code.
# Claude Code:
claude mcp add injectshield --env INJECTSHIELD_API_KEY=is_live_… -- npx -y @injectshield/mcpFor Cursor / Cline / other MCP clients, see packages/injectshield-mcp/README.md.
# 1) Get a key (delivered by email):
curl -X POST https://api.injectshield.dev/v1/keys \
-H "Content-Type: application/json" \
-d '{"email":"[email protected]"}'
# 2) Scan:
curl -X POST https://api.injectshield.dev/v1/scan \
-H "Authorization: Bearer is_live_..." \
-H "Content-Type: application/json" \
-d '{"text":"ignore previous instructions","context":"user_input"}'Or signup via the landing page: https://injectshield.dev — self-serve, email delivery.
Live:
https://api.injectshield.devOpen-source (this repo, MIT):
src/patterns.ts — the heuristic pattern library (~20 categorized rules).src/detect.ts — the detection engine (heuristic aggregation, sanitization).test/ — the test suite.server/, public/ — the full API + landing-page source.Managed only (paid tiers):
| Category | Examples |
|---|---|
instruction_injection | "ignore previous instructions", "new system prompt" |
system_override | system-prompt leak, role-tag forgery, ChatML/Llama special tokens |
role_hijack | "you are now…", DAN, Developer Mode |
exfiltration | data sent to attacker URLs, markdown image exfil |
schema_attack | OpenClaw-style schema references |
encoding_smuggle | base64-decoded directives |
invisible_text | zero-width / bidi / Unicode-Tag smuggling |
tool_abuse | synthetic tool-call directives in untrusted text |
jailbreak_classic | DAN, "no restrictions", etc. |
Found a novel attack? Open a PR adding a PatternRule to src/patterns.ts with:
id.category from the enum above.weight in [0, 1] — pick conservatively; the aggregation in detect.ts combines weights so every additional rule contributes meaningfully but isn't dominant.test/detect.test.ts covering both a positive and a likely-benign negative example.We auto-deploy merged patterns to the managed API. No-cost contributions get attribution in the changelog.
npm install
npm test # 11 tests, ~20ms
DATABASE_URL=postgres://... npm run dev # boots Hono on :8080MIT. InjectShield reduces but does not eliminate prompt-injection risk.
Built on Cloudflare Pages (frontend) + Railway (API) + Postgres + Anthropic Claude (semantic layer). Pattern library informed by HackAPrompt, the PINT benchmark, and a long list of public attack examples.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.