rogerchappel/promptlintel

PromptLintel 🧱

PromptLintel is a local CLI that lint-checks prompt-like files before agents ingest them. It looks for prompt-injection footguns, secret-shaped strings, unsafe external-action wording, and missing provenance or safety boundaries.

It is deliberately boring in the best way: deterministic rules, stable Markdown/JSON reports, no telemetry, no network calls, and no surprise file edits.

Install

PromptLintel is not published to npm yet. Until the first release is available, install and run it from a checkout:

git clone https://github.com/rogerchappel/promptlintel.git
cd promptlintel
npm install
npm run build
node dist/cli.js scan examples/fixtures --fail-on high

Quick start

node dist/cli.js scan AGENTS.md skills/**/*.md --out promptlintel-report.md
node dist/cli.js scan prompts/ --format json --fail-on high
node dist/cli.js rules --format markdown

A failing result means at least one finding met or exceeded --fail-on (info, low, medium, high, or critical). Invalid commands, options, option values, and configuration exit with status 2 and a diagnostic on stderr. When --out targets a missing directory, PromptLintel creates every required parent directory before writing the report. Output is written to the file instead of stdout, without changing scan or finding exit semantics.

Every explicit file, directory, or glob must match at least one prompt file. An unmatched input—also when combined with matched inputs—prints a diagnostic and exits with status 2 without producing a report, so misspelled CI inputs cannot silently pass. Recursive globstars match zero or more directory levels, so skills//.md includes both skills/root.md and files in nested directories. Globs support , , ?, and character classes: [ab] matches either character, [a-z] matches a range, and [!ab] or [^ab] matches any character except those listed. A class cannot contain /; empty, unclosed, or otherwise unsupported bracket syntax is matched literally.

What it catches

• Prompt injection footguns — phrases like “ignore previous instructions” or hidden-directive wording.
• Secret-like strings — token/API-key/private-key patterns that should not live in prompt files.
• Unsafe external actions — wording that encourages sending, posting, deleting, purchasing, or publishing without approval.
• Missing provenance — prompt files with no source, owner, context, or attribution.
• Missing safety boundary — prompt files with no safety, permissions, security, or red-lines section.

Inline allows

Use allows sparingly and visibly. They are for quoted examples, fixtures, and documented exceptions — not for hiding risk.

<!-- promptlintel-allow injection-ignore-prior-instructions -->
A malicious prompt may say: ignore previous instructions.

Use promptlintel-allow only in small fixture files where every finding is intentional.

Config

promptlintel.config.json can disable defaults, add local rules, or set the default fail threshold: