What prompt injection is
Any text that reaches a model is a candidate instruction. If your application inserts a retrieved document, a user upload or a scraped page into a prompt, whoever wrote that content can attempt to address the model directly.
The consequences scale with what the model can do. For a summariser it is embarrassing. For an agent with tools it is a security incident, because the injected instruction can drive real actions.
What this scanner can and cannot do
It matches published patterns: the phrasings that appear repeatedly in documented attacks. That covers opportunistic and copy-pasted attempts, which is the majority of what most applications encounter.
It will not catch a novel or paraphrased injection, and it cannot catch one written in a language it does not pattern-match. A clean result is not a safety guarantee — treat untrusted text as untrusted regardless of what this says.
What actually reduces the risk
Structural defences beat detection. Keep untrusted content inside a delimited block and state plainly that content within it is data, not instructions. Never let retrieved text sit adjacent to your own instructions without a boundary.
Then limit the blast radius: give agents the narrowest tool permissions that work, require confirmation for anything irreversible, and never place secrets in a context that untrusted content also occupies.
Detection is a useful additional layer. It is not the layer that saves you.