Utilumo
LightDarkSystem
Guide1 min readUpdated September 1, 2026

How to scan text for prompt injection

Short answer

Scan for override instructions, system-prompt disclosure requests, secret exfiltration, role labels, hidden markup, and encoded strings. Then treat the text as untrusted data and keep tool permissions narrow.

Scan before retrieval becomes instructions

Indirect prompt injection often hides inside pages, comments, documents, or emails that an AI workflow is asked to summarize. Review the text before a model can treat it as instructions.

  • Override phrases like ignore previous instructions.
  • Disclosure requests like show the system prompt.
  • Secret movement requests like send API keys.
  • Role labels such as system: or hidden HTML comments.
  • Long encoded strings that should be decoded and inspected.
Try it: Prompt Injection ScannerScan untrusted prompt text locally and copy a manual review checklist.Open tool
A scanner is not enoughPattern scans reduce risk, but they do not prove safety. Least privilege, output validation, and human confirmation are still required for sensitive tool actions.

References

Questions

Can prompt injection be detected perfectly?

No. A scanner can flag common signals, but prompt injection is context-dependent and can be novel or indirect.

What should I do with flagged text?

Quote it as untrusted data, remove hidden instructions, avoid exposing secrets, and require approval before external actions.

Does this send my data anywhere?

No. Utilumo's developer tools parse and transform input inside the browser tab. Nothing is uploaded, stored, or logged.

Keep reading

Explainer1 min readWhat is prompt injection?Prompt injection is when hidden instructions in input trick an AI model into ignoring its real task. Here is how it works and how to reduce the risk.Read
Guide1 min readHow to write a better AI promptClear context, a specific task, and a defined output format make AI prompts far more reliable. Here is a practical structure and the habits that help.Read