PromptShield is an offline-first prompt-injection hygiene agent for teams running LLM workflows. It scans untrusted text and instruction repositories, explains deterministic matches, and produces a review queue. It never executes a discovered instruction, calls a model, or changes source files.
It is for LLM operators who ingest tickets, documents, web pages, emails, or connector payloads and need a repeatable preflight check before those texts reach an agent.
Quick start
./install.sh # one-shot, stdlib only, offline
python3 agent.py --help
# Two fixtures ship with the pack: one benign ticket, one carrying an injection.
python3 agent.py scan --input examples/clean_ticket.txt # verdict: clean, exit 0
python3 agent.py scan --input examples/hostile_ticket.txt \
--output promptshield-report.json --fail-on high # verdict: review, exit 2
bash smoke_test.sh runs 16 end-to-end checks offline; bash deploy.sh (root)
installs the systemd unit and an hourly timer.
untrusted input -> normalize -> deterministic rules -> findings -> review report
| |
+---- optional BYO-LLM ---+ (never required)
scan is deliberately conservative: a finding is evidence for review, not proof of malice. Use --fail-on high in a CI or ingestion gate. No API key is needed; the optional local Claude/Kimi/Codex adapter is only used by explain when explicitly requested.
Safety boundary
The pack reads local files only. It does not fetch URLs, send data, execute embedded commands, or redact/mutate an input. Keep secrets out of sample files and review high-severity findings before blocking a workflow.
See CHECKLIST.md for rollout, CUSTOMIZE.md for rules and integrations, and SPEC.md for the stable JSON contract.