Skip to main content
Glama
Sign In
Panda Web Security Tools

Panda Web Security Tools

by pandadad0214
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

Hidden AI Instructions Scanner: Prompt Injection Detector

hidden_ai_instructions_scanner
Read-only

Scan web pages for hidden text and instructions aimed at AI agents, then classify findings as policy notices, manipulation, or prompt injection with locations and excerpts.

Instructions

Scan web pages for text hidden from people but read by AI agents (display:none, off-screen, tiny or same-color text, HTML comments, alt/meta/data attributes, zero-width and Unicode tag characters) and classify it as policy notice, manipulation or harmful prompt injection, with location and excerpt. Unlike ai_search_seo_audit (visible SEO and AI-readiness) and website_change_monitor (diffs over time), this is a security check on content an agent is about to read. Use when an agent or workflow will ingest a page and you need to know whether it carries hidden instructions, or when auditing your own site. Do not use for SEO grading (use ai_search_seo_audit) or for email security (use email_domain_security_checker). Parameters: renderJs=true runs a real browser to catch script-injected text (much slower, plus settleSecs per page); off is a fast HTTP read. agentUaDiff adds three fetches per page (GPTBot, ClaudeBot, ChatGPT-User) to detect cloaking. crawlDepth follows same-site links but maxPages always caps the run. Findings are leads for review, not proof of intent. Returns per item: page summaries (type page-summary, url, verdict, findings, categories, topSeverity, techniques, agentSummary) and findings (technique, location, excerpt, category, severity).

Behavior: read-only; runs the Apify Actor pandadad0214/hidden-ai-instructions-scanner (https://apify.com/pandadad0214/hidden-ai-instructions-scanner) on your own Apify account. Price: free (no per-result charge). Runs that find nothing are not charged per result, and spending is capped per call by run_max_charge_usd (default $0.50). run_max_items (default 50) limits items returned and fills maxPages when you leave it unset, so it also limits what is billed; setting maxPages higher can bill more than is returned. Most calls finish in 5-15 s for a few inputs; large inputs or crawls can take minutes, so raise run_timeout_secs (max 300) or shrink the input after a timeout error. Returns JSON {actor, count, items}; long text output is trimmed to whole items, with all items in structuredContent.

Input Schema

NameRequiredDescriptionDefault
urlsYesPage URLs. Pages to scan, one per line. Each URL is scanned once; links are not followed.
maxPagesNoMax pages. Hard cap on pages scanned in one run.
renderJsNoRender JavaScript (browser). Off: fast HTTP fetch, reads inline styles, rules, comments, meta, data-* and other attributes, JSON-LD/script data blocks, iframe srcdoc and Unicode tricks. On: loads each page in headless Chromium, waits for network idle plus the settle time (catches delayed injections), checks the computed style of every element, and walks open shadow roots and same-origin iframes.
crawlDepthNoCrawl depth. 0 = only the URLs you give. 1+ = also follow same-site links that many clicks deep (signed-out pages only). Max pages still caps the run.
settleSecsNoWait after load (render mode). Extra wait after network idle so text injected on a timer is caught.
agentUaDiffNoCheck AI-agent cloaking. Also fetch each page as GPTBot, ClaudeBot and ChatGPT-User and flag AI-addressed text served to those agents but not to a normal browser.
minSeverityNoMinimum severity. Drop findings below this severity. Choices: low = Low (include policy notices); medium = Medium; high = High only.low
timeoutSecsNoPage timeout. Per-page load timeout.
run_max_itemsNoOptional. Most results to return from this call (default from PANDA_MAX_ITEMS, 50). Also limits how many results the Actor produces and charges for, unless you set its own max field.
run_timeout_secsNoOptional. Seconds to wait for results (default from PANDA_TIMEOUT_SECS, 120; max 300).
run_max_charge_usdNoOptional. Hard spending cap for this call in USD (default from PANDA_MAX_CHARGE_USD, 0.50).

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/openWorld/non-destructive, and the description goes well beyond them: it names the backing Actor, states pricing (free, no per-result charge, uncapped-find runs not billed), the per-call spend cap, runtime expectations (5-15s typical, minutes for crawls), timeout remediation, and the important epistemic caveat that 'findings are leads for review, not proof of intent.' It also discloses the trimming behavior of long output.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose, differentiation, and exclusions are front-loaded in the first two sentences, and the parameter and pricing notes follow logically. It is dense and long for a single paragraph, with several clause-heavy sentences, but essentially every sentence carries operational information rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 11-parameter tool with no output schema, the description covers the missing return shape explicitly (page-summary items and finding items with technique, location, excerpt, category, severity). Combined with runtime, cost, and timeout guidance, an agent has everything needed to call it correctly and interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline would be 3, but the description adds genuine cross-parameter meaning: renderJs=true is 'much slower, plus settleSecs per page,' agentUaDiff 'adds three fetches per page,' crawlDepth is capped by maxPages, and run_max_items 'fills maxPages when you leave it unset, so it also limits what is billed.' That billing/limit interaction is not derivable from the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Scan web pages for text hidden from people but read by AI agents') and immediately enumerates the detection techniques. It explicitly distinguishes itself from both named siblings (ai_search_seo_audit for visible SEO, website_change_monitor for diffs), so an agent can disambiguate without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use ('when an agent or workflow will ingest a page and you need to know whether it carries hidden instructions, or when auditing your own site') and explicit when-not-to-use with the alternative named for each ('Do not use for SEO grading... or for email security'). This is the full when/when-not/alternatives pattern.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools