scan_injection
Runs a curated signature corpus over a piece of untrusted text — content an agent is about to consume, a retrieved document, a tool result, an email body — and returns the matched injection patterns plus a bounded 0..1 risk score. This is a signal, never a policy decision: the caller decides what to do with a flagged input.
Detected classes: instruction_override (ignore/override previous rules), role_reassignment (you are now DAN / developer mode), exfiltration (leak the system prompt or a secret to a URL), tool_smuggling (covertly invoke a tool, delete/destroy data), boundary_spoof (fake system/assistant turn delimiters). Input is normalized first to blunt cheap evasions (zero-width characters, smart quotes, whitespace padding).
Use this tool when:
You are an agent about to feed retrieved or third-party text into a model and want to check it for embedded instructions first.
You are triaging why a tool description or web page looks suspicious.
Do NOT use this tool when:
You want a trust verdict on a domain or entity — use
cross_lens_verify.You want to scan a whole MCP server's tools — use
scan_mcp.
Inputs:
text(body, required): the untrusted text to scan. Max 200,000 chars.
Returns:
flagged: true if any signature matched.score: bounded 0..1 risk score (saturating — one high-severity hit is already strongly flagged; many hits approach but never exceed 1).severity_max: highest severity among matches (high/medium/low) or null.classes: distinct injection classes matched.matches: each matched signature{ id, class, severity, excerpt }.
Cost:
Free. No API key required. Pure edge computation, no external calls.
Latency:
Typical <20ms.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | Untrusted text to scan for injection signatures. |