Injectcheck

injectcheck

Scan the content your agent is about to read, before your agent reads it.

Quickstart

npx @reneturcios/injectcheck scan ./repo

AI agents now work from untrusted text all day: issue bodies, PR descriptions, README files, code comments, docs pages. Anyone who can open an issue can put words in front of your agent, and some of those words are instructions aimed at the agent, not at you. In October 2026, reporting on AI-orchestrated attacks (the Anthropic GTG campaigns, the Shai-Hulud npm worm) showed agents being steered by content planted in repos and packages. The cheapest defense is a boring one: scan the text first, with deterministic rules, and show a human the exact lines that look like an attack.

injectcheck does that scan. It reads a directory, a single file, or raw text, applies seven deterministic rules, and reports every finding with file, line, rule id, severity, and an excerpt. No model, no network, no guesses about intent beyond the patterns.

It never claims content is safe. The clean verdict is CLEAN, and CLEAN means only that no pattern matched.

What it checks

Scoring and verdicts:

• FINDINGS: any high severity finding, or 3 or more medium findings. Exit code 1.
• REVIEW: any medium or low finding that does not reach the FINDINGS bar. Exit code 1.
• CLEAN: no rule matched. Exit code 0.

HTML comments are scanned as a unit: the whole comment body, across every line it spans, is normalized (line continuations removed, whitespace collapsed) before the rules run, so a payload split across comment lines matches the same way it would on one line.

JSON reports are scanned the same way. Machine-readable output is what agents actually pipe from tool to tool, so a .json file is scanned through its string values and keys (extracted and escape-decoded) with the full rule pass: a persistence command sitting in a report's command field fires tool-lure at high, exactly as it does in the report's human rendering or in a plain text file. The known limits below state the extraction scope and bound.

Instruction-phrase grading, the choice stated plainly: an override verb plus a temporal marker plus a directive noun (the canonical "ignore all preceding orders", "forget all previous tasks" shape) scores high, with or without an explicit mention of an AI, because that sentence shape has almost no legitimate use inside content written for someone else to act on. The same override without a temporal marker scores high only when the text also carries an agent-directed follow-on (a new task or new instructions for the reader); on its own it scores medium, because people also write that way about their own task lists. The noun set deliberately excludes ordinary objects, so "ignore previous versions and upgrade" in a changelog does not fire at all. Phrases quoted inside documentation that describes the patterns score low, as before.

Documentation about prompt injection does not verdict FINDINGS by design. The patterns require actual instruction phrasing, exfil shapes, or hidden characters, not the mere mention of the topic, and negated safety advice is reported at low severity so it stays visible without blocking anyone. Two tuning rules keep honest docs honest: an exfil verb near a credential noun only scores high in directive shape (an imperative, a "contents of" request, a URL destination), while third-person narrative about an attack scores low; and instruction phrases quoted inside documentation that describes the patterns (detector docs, security writeups) score low instead of high. This is tested against real documents: the spec this tool was built from scans at REVIEW with only low findings, never FINDINGS.

Quoted payloads in security writing grade as documentation too. A payload that appears inside quotation marks or a blockquote, accompanied by attribution or reporting framing ("The attacker planted the following text in an issue: ...", "A researcher documented the payload ..."), is a payload being described, not one being issued, and its instruction and exfil findings score low. The framing may follow the quote instead of preceding it (the quote first, then "The preceding sentence is a payload that an attacker planted in an issue, quoted verbatim in a maintainer writeup..."), as long as it stays within the same paragraph or the immediately following sentence. The framing is required: a bare quote with only a neutral lead-in earns no downgrade, and the same payload without the framing verdicts FINDINGS as before.

Attribution can be structural as well as sentential. Security reports and changelogs present payloads as exhibits: a labeled evidence or output excerpt, a quoted line inside a finding listing, a Method or Evidence or Justification section that describes the payload core, or a fix-note bullet (problem-numbered, or under a version heading) that narrates what the scanner now catches, now scans, or no longer fires on. Payload text exhibited in those contexts, in quotation marks or backticks or as the described subject of the segment, grades low for the instruction, exfil, and tool-lure rules, the same grade as a payload inside a framed quotation. The structural signals are never a genre marker alone: a bare payload placed under a version heading with no label, no listing, and no narration about the payload keeps its live grade and verdicts FINDINGS, and so does a bare payload paragraph in a report-shaped document. A fenced block counts as an exhibit when an attribution label (Evidence, Output, Example, Quote, Excerpt, and similar short colon lines) introduces it, including when one blank line sits between the label and the fence, the conventional report layout. The label vocabulary is the guard: a bare payload in a fence with no label, and a fence introduced by an instruction-shaped line such as "Run this:", both keep their live grade and verdict FINDINGS.

Hidden-unicode severity scales with density and clustering. A character embedded inside a word (a letter or digit on both sides) grades medium at any count, because splitting a word is the concealment shape. Sparse isolated characters at word or sentence boundaries (the copy-paste debris shape: exactly two zero-width characters in ordinary prose) grade low. A distributed density of invisible characters (a zero-width space after every space, a formatting transform) grades low however many a line holds: high requires a concealment shape, a cluster of five or more consecutive invisible characters or an encoding density (invisible characters at least half as numerous as the visible non-space characters on the line), and hidden-unicode findings alone never carry a text to FINDINGS at medium strength without corroboration from another rule family. One known convention is named in the finding detail rather than graded differently: GitHub release notes rendered into dependabot PR bodies write a mention as @ + zero-width space + username, the standard mention-ping suppression convention, and a line matching that exact pattern says so.

An AI-authorship disclosure is not an address. A line like "Written with AI" is declarative attribution; when it sits near imperative-mood summary prose (the standard shape of an AI-assisted PR description: "Execute... Preserve... Add..."), the cross-line matcher no longer joins the two into an imperative addressed to an AI. A genuine directive shape still fires: an explicit agent address ("Note for the AI") followed by an imperative, or a second-person imperative aimed at the reader.

Machine-written provenance is not an instruction either. GitHub Agentic Workflows stamps issue and PR bodies with a provenance comment naming the workflow, the engine, and a link to the workflow run; that marker is metadata about who produced the body. A lure or instruction token inside a provenance-shaped comment counts only at full command strength, and a run label whose value is a URL (a CI link label, the provenance run field) is a link, not a command: the run-colon lure requires a command value after the colon. A provenance-shaped comment that also carries a real instruction or a real command still fires at full grade.

OAuth protocol constants are not credentials. Fenced repro code in auth repositories compares grant-type and response-type literals and returns token-response objects through response helpers; when the credential-shaped token in a fenced block is one of those protocol constants (or a quoted placeholder value in a status-code response-helper call) and the nearby verb is a code identifier rather than an action on credential data, the exfil pairing is discounted. The same verb and credential shape in prose aimed at an agent keeps its grade, and fenced code that touches credential files or environment secrets anywhere near the verb is untouched.

The exfil rules also cover the parameter channel. A tool description that directs the reader to read credential-class files and move their contents out through a named tool parameter or argument, corroborated by directive language or by suppression language (an instruction not to mention the read), grades as exfiltration at high. The rule is the combination, never a single token: ordinary tool documentation that mentions reading files and parameters, descriptive narration of the same mechanics, and a parameter transfer of a non-credential file do not fire