Prompt Injection Shield

About

AI assistants and browser agents increasingly read the page you're on to summarize, answer, or act for you. Attackers exploit this by planting instructions that are invisible to humans but readable by AI — white-on-white text, display:none blocks, off-screen elements, and characters smuggled through zero-width or Unicode "Tags" code points. This is called prompt injection, and one hidden line can hijack an assistant.

Prompt Injection Shield scans the current page and surfaces these threats, ranked by severity, before an assistant acts on them.

What it finds: • Visually hidden text — display:none, opacity:0, tiny fonts, off-screen positioning, clipped boxes, low-contrast camouflage, aria-hidden content. • Hidden channels — HTML comments, title/alt/aria-label/data-* attributes, meta tags, hidden inputs. • Unicode steganography — zero-width characters, bidirectional overrides, and the Unicode Tags block (decoded back to readable text). • Prompt-injection phrasing — "ignore previous instructions", role reassignment, fake chat turns, <system>/[INST] markup, and more.

Privacy first: everything runs locally in your browser. No data is collected, stored, or transmitted — ever.