Prompt-injection scanner for Flowise agents

Where multimodal PI enters a Flowise chatflow

ChatOpenAI / ChatAnthropic with Allow Image Uploads. When you enable Allow Image Uploads on a vision-capable chat model node in Flowise, end users of your chatflow can upload images alongside their text messages. Flowise passes these images as image_url or image content blocks to the model API. There is no built-in scan of the image content. Any user can upload a FigStep-class image — a PNG with adversarial typography or a steganographically encoded instruction — that the vision model reads and acts on.

PDF File Loader in Document QA Chains. Flowise's PDF File loader (using pdf-parse or pdfjs-dist under the hood) extracts text from uploaded PDFs. However, PDF pages that are scanned images or that contain embedded image content are not text-extractable — they are passed as rendered images to a multimodal LLM node. This is the same attack surface described in PDF prompt-injection detection: a payload on an image-only page in the PDF reaches the vision encoder unfiltered.

Image File Loader + Vision Chain. Flowise supports image loading for multi-image analysis chains. A user who can supply images to this chain can supply adversarial images. For document-processing chatflows where users upload product photos, receipt images, or screenshot captures, each user-supplied image is an untrusted input.

Agent tools that fetch images. Flowise agents configured with web-search or URL-fetch tools may retrieve images from external URLs and pass them to a vision model for analysis. External-origin images are untrusted. See indirect prompt injection via image for the retrieved-image attack pattern.

Option 1: Express middleware hook (self-hosted Flowise)

For self-hosted Flowise, the cleanest approach is to add an Express middleware that intercepts multipart uploads before they reach the Flowise route handler:

// flowise-pi-scan-middleware.js
const axios = require("axios");

const GLYPHWARD_API_KEY = process.env.GLYPHWARD_API_KEY;
const GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan";
const SCAN_THRESHOLD = 70;

async function scanImageBuffer(buffer, mimeType, filename) {
  const base64 = buffer.toString("base64");
  const response = await axios.post(
    GLYPHWARD_SCAN_URL,
    { image: base64, source: "flowise_upload", metadata: { filename } },
    {
      headers: { Authorization: `Bearer ${GLYPHWARD_API_KEY}` },
      timeout: 5000,
    }
  );
  return response.data; // { score, flagged_region, scan_id, modality }
}

// Attach to Flowise Express app before flowise routes
module.exports = function piScanMiddleware(req, res, next) {
  // Only intercept routes that handle file uploads
  if (!req.path.includes("/api/v1/prediction") || !req.files) {
    return next();
  }
  const images = Object.values(req.files).flat().filter(
    (f) => f.mimetype.startsWith("image/") || f.mimetype === "application/pdf"
  );
  if (images.length === 0) return next();

  Promise.all(
    images.map(async (file) => {
      const result = await scanImageBuffer(
        file.data,
        file.mimetype,
        file.name
      );
      if (result.score >= SCAN_THRESHOLD) {
        throw Object.assign(
          new Error(`Image blocked: PI score ${result.score}`),
          { scan_id: result.scan_id, status: 400 }
        );
      }
      return result;
    })
  )
    .then(() => next())
    .catch((err) => {
      res.status(err.status || 500).json({
        error: err.message,
        scan_id: err.scan_id,
      });
    });
};

Mount this middleware in Flowise's main index.js or in your custom Docker entrypoint before the router.use(flowiseRouter) line:

const piScan = require("./flowise-pi-scan-middleware");
app.use(piScan);
app.use("/api/v1", flowiseRouter);

Option 2: Custom tool node (cloud-hosted or self-hosted)

If you use Flowise Cloud or cannot modify the server code, create a Custom JS Function node in your chatflow that calls Glyphward before the LLM node:

// Flowise Custom JS Function node
// Input: $image (base64 string from upload variable)
// Output: { passed: true } or throws error

const response = await fetch("https://glyphward.com/v1/scan", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Authorization": `Bearer ${$vars.GLYPHWARD_API_KEY}`,
  },
  body: JSON.stringify({
    image: $image,
    source: "flowise_custom_fn",
  }),
});

const result = await response.json();

if (result.score >= 70) {
  throw new Error(
    `Image blocked by PI scanner (score ${result.score}). ` +
    `Please upload a different image. scan_id=${result.scan_id}`
  );
}

return { passed: true, scan_id: result.scan_id, score: result.score };

Wire this node between the Image Upload variable and the ChatOpenAI node. If the function throws, Flowise terminates the chain and returns the error message to the chat interface.

Get early access

Coverage matrix

Related questions

Further reading

• FigStep detection — the typographic attack class in image uploads.
• Indirect prompt injection via image — PI in document-loader and URL-fetcher paths.
• PDF prompt-injection detection — scanning PDF pages rendered as images.
• Prompt-injection scanner for Dify agents — analogous HTTP-node approach for Dify workflows.
• Prompt-injection scanner for LangChain agents — Flowise uses LangChain under the hood.
• Prompt-injection scanner for RAG pipelines — document ingestion PI patterns.
• Vision language model security — why the visual token stream bypasses text defences.