Metadata-Version: 2.4
Name: prompt-injection-blocker
Version: 0.1.4
Summary: Read-only scanner for prompt-injection and LLM anti-analysis text in files before agent review
Author: Dragon Lady
License-Expression: MIT
Project-URL: Homepage, https://github.com/Dragon-Lady/prompt-injection-blocker
Project-URL: Repository, https://github.com/Dragon-Lady/prompt-injection-blocker
Project-URL: Issues, https://github.com/Dragon-Lady/prompt-injection-blocker/issues
Keywords: security,prompt-injection,llm,ai-agents,promptware,anti-analysis,scanner
Classifier: Development Status :: 3 - Alpha
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: System Administrators
Classifier: Operating System :: OS Independent
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Provides-Extra: dev
Requires-Dist: pytest<10,>=8; extra == "dev"
Dynamic: license-file

# Prompt Injection Blocker

Read-only scanner for prompt-injection and LLM anti-analysis text in files
before agent review.

This tool is meant for defensive intake: copied advisories, incident notes,
third-party repositories, docs, issues, and fixtures that may contain text aimed
at overriding an AI assistant or suppressing analysis.

It does not remove files, modify content, execute code, contact registries, or
prove that content is safe.

## Install

```sh
pipx install prompt-injection-blocker
# or
pip install prompt-injection-blocker
```

Python 3.9+. No runtime dependencies.

## Usage

```sh
prompt-injection-blocker /path/to/project
prompt-injection-blocker /path/to/project --json
prompt-injection-blocker /path/to/project --report report.json
```

From a source checkout:

```sh
python -m prompt_injection_blocker /path/to/project
pip install -e ".[dev]" && pytest
```

Exit codes:

- `0`: no blocking promptware patterns found
- `1`: usage or runtime error
- `2`: blocking promptware patterns found

## What It Flags

- prompt-injection text that tries to override prior/system/developer
  instructions
- text asking an agent to reveal secrets, hidden instructions, environment
  variables, or tokens
- text trying to make an agent run commands or fetch external content
- observability/tool-output text, such as fake Sentry resolutions, that tries
  to make an agent run package-manager diagnostics
- LLM-targeted anti-analysis language that tells scanners not to report
  suspicious content
- model-scanner refusal/null-result bait that tries to make an analysis
  pipeline stop before reaching suspicious payload code
- Microsoft Copilot / AI-assistant links where a `q=` query parameter appears
  to carry private-context requests plus external exfiltration instructions
- broad repo-local agent instruction language that deserves review before
  opening a path in automated agents
- recognized agent instruction, skill, and MCP configuration paths, even when
  their contents look benign, so provenance and scope receive human review
- known phrase families after Unicode compatibility normalization, removal of
  invisible format characters, and defanging of simple HTML separators

The rules are intentionally conservative. A finding means "do not feed this raw
text into an agent," not "this file is malware."

## Safe Handling

- Do not paste flagged text into agents in raw form.
- Summarize or defang prompt-injection text before sharing with the team.
- If this appears in a third-party repository, do not open the repo in agents or
  editors until reviewed.
- If a test needs one of these markers, split or encode it so the test remains
  meaningful without carrying live promptware. This codebase stores all of its
  own detection markers split and joins them at runtime; keep that discipline
  when adding rules.
- Treat model refusal as a failed analysis, not a clean result. Send the file
  through static checks, sandboxing, or human review instead of allowing a
  null response to pass.
- Treat unfamiliar setup commands and anything they fetch at runtime as
  untrusted code. A clean text scan cannot establish what a later network
  response or package installation will execute.

## Scope Limits

This scanner only checks text-like files and known phrase families. It will not
detect every possible prompt-injection attempt, encoded payload, image-only
instruction, runtime-fetched instruction, behavioral setup chain, or
model-specific attack. Use it as one deterministic intake layer alongside
provenance review, sandboxing, least-privilege tools, network controls, and
human approval for consequential actions.
