Check a document for prompt-injection risk signals.
Prompt injection does not require malware: ordinary-looking text can contain instructions intended for an AI system rather than the human reader. ScrubMyText combines heuristic instruction scanning with deterministic checks for hidden and machine-readable document content.
What the scanner looks for
The instruction scanner flags patterns such as attempts to override prior instructions, extract system/developer prompts, coerce tool use, impersonate model roles, or exfiltrate secrets. It also checks invisible Unicode and document structures that can make instructions less obvious to a human reviewer.
Document-specific checks
Word files are inspected for hidden runs, comments, tracked-deleted text, custom XML, macros, and external relationships. PDFs are inspected for text-layer geometry, annotations, metadata, attachments, and JavaScript actions. HTML is checked for hidden elements, comments, hidden inputs, and scripts.
Why it is a risk signal, not a verdict
A security policy, academic paper, support ticket, or developer document can legitimately contain phrases like “ignore previous instructions.” Conversely, a malicious instruction can be phrased subtly enough to avoid simple pattern matching. The scanner is designed to surface content for human review, not make a final trust decision.