System Prompt Security Audit & Injection Vulnerability Scanner
Paste your production system prompt and tool descriptions to score instruction-override, role-hijack, and exfiltration exposure before deployment.
Find the design weaknesses that let a single crafted user message flip your agent’s behavior.
Stress-Test Your Agent
The instructions that define your agent's role, tools, and rules. Scanned for design weaknesses that make injection possible.
High-privilege tools (email, shell, payments) widen the blast radius of an injection. The scanner flags tool-chaining abuse.
Simulates what a hostile document could whisper to your agent. Try the Poisoned RAG Document preset on this page for a live payload.
Hardened — no known injection signatures matched. Keep guardrails on regressions.
12 Attack Families Scanned
Deterministic signature coverage — re-runs identically on the same input. No random LLM judgment involved.
How the score works
- Every prompt starts at 100. Each matched attack family deducts points by severity: Critical −26, High −15, Medium −9, scaled up to 2× when a family matches multiple times.
- Instruction Override, Role Hijack, and Tool Abuse are scored Critical because they can flip agent behavior or move data through connected tools.
- Scanning covers all three attack surfaces at once: the model prompt, the tool layer, and indirect content injection via RAG documents, emails, and web pages.
- Signature detection catches known attack phrasing and structures. For adversarial paraphrase robustness, run the prompt through live red-team models behind CadreGPT's guardrails.
Manual Approach vs. Governed CadreGPT Enterprise
Why organizations transition from unmanaged scripts to governed autonomous agent workspaces.
| Feature Dimension | Manual / Unmanaged Way | Automated with CadreGPT Enterprise |
|---|---|---|
| Injection Detection | Discovering hijack payloads only after a jailbroken agent leaks prompts or executes hostile tool calls in production. | Deterministic 12-family signature scan with severity-scored findings and copy-paste fixes before deployment. |
| Data Privacy | Pasting proprietary agent prompts into third-party AI checkers that train on or log the input. | Scanning executes entirely in your browser for free tools, and CadreGPT guardrails enforce zero-retention commercial API terms at runtime. |
| Indirect (RAG) Injection | Assuming retrieved documents are neutral text while hostile emails and web pages whisper commands to the model. | Dedicated indirect-payload checks for hidden text, forged delimiters, and external-authority commands, plus delimiter isolation guidance. |
| Runtime Enforcement | Static scanner results rot the moment someone edits the prompt, with no link between findings and mitigation. | Zod-validated tool parameters, sandboxed execution with network egress policies, and human approval gates bind every flagged risk to a control. |
Frequently Asked Questions
Technical answers and operational best practices for System Prompt Audit.