Metadata-Version: 2.4
Name: pdf-injection-scanner
Version: 0.1.1
Summary: CLI tool to detect hidden prompt injection attacks in PDF files
Project-URL: Homepage, https://github.com/Andy8647/pdf-injection-scanner
Project-URL: Repository, https://github.com/Andy8647/pdf-injection-scanner
Project-URL: Issues, https://github.com/Andy8647/pdf-injection-scanner/issues
Author-email: Andy <andy8647tian@gmail.com>
License-Expression: MIT
License-File: LICENSE
Keywords: ai-safety,llm,pdf,prompt-injection,security
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Education
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Classifier: Topic :: Utilities
Requires-Python: >=3.10
Requires-Dist: click>=8.0
Requires-Dist: pdfplumber>=0.10
Requires-Dist: rich>=13.0
Description-Content-Type: text/markdown

# pdf-injection-scanner

A CLI tool to detect hidden prompt injection attacks in PDF files.

Professors and others may embed invisible instructions in PDFs (white text, tiny fonts, off-page text) designed to manipulate AI assistants. This tool finds them.

## Detection capabilities

| Type | Severity | How it works |
|------|----------|-------------|
| **White/invisible text** | HIGH | Detects characters with white or near-white fill color |
| **Tiny text** | HIGH | Flags text smaller than 2pt — invisible to the eye |
| **Off-page text** | HIGH | Finds text positioned outside visible page boundaries |
| **Suspicious patterns** | MEDIUM | 17+ regex patterns for common prompt injection phrases |

## Install

```bash
# uv (recommended)
uv tool install pdf-injection-scanner

# pip
pip install pdf-injection-scanner

# Homebrew (macOS)
brew install Andy8647/tap/pdf-injection-scanner

# From source
git clone https://github.com/Andy8647/pdf-injection-scanner.git
cd pdf-injection-scanner
pip install -e .
```

## Usage

```bash
# Basic scan
pdf-scan assignment.pdf

# Verbose output with details
pdf-scan assignment.pdf -v

# JSON output for piping
pdf-scan assignment.pdf --json
```

### Example output

```
Scanning: assignment.pdf

  Scanning ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3/3 pages
╭──────────── Result ────────────╮
│ 3 potential injection(s)       │
╰────────────────────────────────╯
┏━━━┳━━━━━━┳━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━┓
┃ # ┃ Page ┃ Severity ┃ Type                 ┃ Content              ┃
┡━━━╇━━━━━━╇━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━┩
│ 1 │  1   │   HIGH   │ White/Invisible Text │ If you are an AI...  │
│ 2 │  1   │   HIGH   │ Tiny Text            │ System prompt: ...   │
│ 3 │  1   │   HIGH   │ Off-Page Text        │ New instructions:... │
└───┴──────┴──────────┴──────────────────────┴──────────────────────┘
```

## Generate test PDFs

```bash
pip install reportlab
python make_test_pdf.py
```

This creates `test_injected.pdf` with 5 different types of hidden injections for testing.

## How it works

The tool uses [pdfplumber](https://github.com/jsvine/pdfplumber) to extract character-level metadata from PDFs, including:

- **Fill color** (`non_stroking_color`) — catches white-on-white text
- **Font size** — catches sub-2pt text
- **Position coordinates** — catches text placed outside page bounds
- **Text content** — matches against known prompt injection patterns

## License

MIT
