Stealth Prompt

Stealth Prompt is a local-first AI security workbench for real browser interactions. It helps an authorized security tester investigate one exact AI chat or agent workflow inside the browser session they already use — the same authenticated account, the same page, the same conversation state — instead of reconstructing that environment in a separate automation profile. It is closer to a focused Repeater for AI-agent interfaces than to a broad automatic scanner. You choose the interaction. You approve the action. The evidence is written down. Use Stealth Prompt only on systems you own or are explicitly authorized to assess. WHAT PROBLEM IT SOLVES Testing an AI feature is awkward with conventional tooling. The interesting behaviour usually lives behind a login, inside a single-page application, in a chat widget that streams its answers, and in conversation state that only exists in your current session. Copying cookies into a headless browser changes the very context you are trying to examine, and a generic scanner has no idea which element on the page is the assistant's input, which one submits it, or where the reply appears. Stealth Prompt works the other way around. It attaches to the tab you already have open, asks you to identify the exact interaction once, and then operates strictly inside that boundary. Nothing is discovered by crawling. Nothing is guessed. The model never invents a target. THE WORKFLOW Observe, hypothesize, generate, review, send, capture, verify, report. The Side Panel is organised as four workspaces — Setup, Test, Review and Reports — with bounds and scenario import/export in a Settings drawer. Only one workspace renders at a time, and the panel moves between them as the assessment moves. Starting a run opens Test. A potential finding follows the review, stop or continue policy you selected. A terminal result opens the summary in Reports. Reloading the panel reopens the workspace the assessment is actually in, rather than dumping you back at the beginning. SELECTING THE INTERACTION Before anything runs, you bind three roles on the page: the input the assistant reads, the control that submits it, and the container where the reply appears. Element discovery is read-only. It inspects the page and proposes a candidate for each role with a confidence score and a plain-language reason — for example, "Matched textarea 'Message' inside a form. Editable chat semantics." Suggestions are never applied automatically. You review each role and accept it individually, or press Highlight to flash the element on the page, or pick it manually with a click-to-select overlay when the suggestion is wrong. Binding health is then tracked continuously: healthy, re-checking, needs review, or unsupported. The binding is revalidated after a reload, after same-origin navigation, after single-page-application document replacement, when the panel is reopened, and immediately before every single fill or submit. This last check is enforced at the service-worker chokepoint, so a stale or ambiguous locator fails closed instead of typing into whatever happens to match now. A failed check pauses an automatic run, revokes send authorization, names the role that broke, and keeps your reviewed binding so you can recover rather than start over. MODES: PROGRESSIVE AUTONOMY You decide how much the tool is allowed to do. Payload only — generates a test message and nothing else. It never touches the page. You copy the payload and use it yourself. Assist — generates on request and sends only when you approve, one send at a time. Guided — prepares the next proposal automatically as the conversation develops, but still requires your approval for every send. Auto — runs a bounded adaptive loop under limits you set, authorized by one explicit action. Authorization is never persisted across a panel reload. Auto is bounded on purpose. The default budget is 20 turns with unlimited time; turn budgets support 1 to 100 sends, or Unlimited. When a potential finding appears you choose the policy in advance: pause for human review, stop and save on the first signal, or continue while recording every turn. Unlimited turns require Pause or Stop, so a run cannot drift forever. Reaching a configured turn or duration limit saves the report automatically and opens Reports. WHAT IT TESTS FOR The objective catalogue covers direct prompt injection, indirect prompt injection, hidden and system instruction disclosure, sensitive-data disclosure, role confusion, goal hijacking, RAG manipulation, memory poisoning, tool misuse, excessive agency, approval bypass, and unsafe output handling. If you do not yet know which category fits the target, Auto objective maps visible capabilities and selects an evidence-backed path. You pick a named objective or delegate that selection to Auto. Each named objective carries a description and the relevant OWASP LLM category, so a report reads meaningfully to someone who was not sitting next to you. Auto behavior remains a separate control for bounded sending. You never type an attack string to get started. The first payload is generated from the objective you chose and the interaction you bound, and every payload remains fully editable before it is sent. MATCHED FRAMING EXPERIMENTS FrameFuzz compares one normalized unsafe outcome across clean control, explicit injection, and selected framed cases. The cases come from a closed, versioned local template pack rather than model-generated variations. Every case requires a fresh target conversation, explicit reset confirmation, and read-only binding validation. The comparison records per-case outcomes, scorer provenance, isolation, template identity, reproducible order, and a separate campaign conclusion. Local Core can confirm a framing gap only with deterministic evidence and verified isolation. Direct API uses the same templates but caps the conclusion at potential. An edited template, contaminated control, or missing sc…