# Prompt injection detection fixtures

Open `index.html` locally to browse 18 standalone HTML pages. Each page presents a routine visible note and contains one hidden instruction. There are six pages per tier and one distinct hiding method per page.

- **Tier 1:** direct role or instruction overrides with familiar wording.
- **Tier 2:** task-shaped directions that ask for extra fields or a validation marker.
- **Tier 3:** natural work requests that try to add fictional identity fields or a harmless command marker to the answer.

`manifest.json` is the test oracle: it maps each filename to its tier, hiding method, and expected payload. It is intentionally separate from the pages. The pages do not run JavaScript, execute commands, make network requests, or contain real personal data. Addresses use the reserved `.invalid` domain, and command examples are `echo` markers.

Run `python generate.py` to regenerate the static pages and index after editing the fixture definitions.