{
  "schema_version": 1,
  "id": "scan-hidden-content",
  "track": "coding",
  "name": "Scan Hidden Content",
  "version": "0.0.2",
  "sha256": "faa2be8ec4e4bd1809939b900f8dfbcf29be4d7ce54ddd0f320ec5a6c92da3cf",
  "sha256_v1": "e8aa8a905c335bb6c917ef7055557245fb2a8a0a4d27f7d5685da6f9a9c2da48",
  "keyword": "warn",
  "word": "warns",
  "says": "warns on an agent's file writes and at turn end",
  "description": "Warns (observe) when a change adds text a reader cannot see, or a URL that carries data out, to Markdown, HTML, SVG, XML, Word, agent instruction files, docs and templates: instruction-like or long comments, CSS-hidden, white or 1pt text, hidden Word runs, URLs with secret words, long queries, placeholders or encoded parts, remote embeds, camo runs, HTML data URIs. Runs: commit, agent write, turn's end. Waiver: a person's marker comment line above. Friction, not a boundary.",
  "misses": null,
  "where": [
    "write",
    "turn-end"
  ],
  "groups": [
    "prompt-injection"
  ],
  "eval_cases": 45,
  "eval_executed": 44,
  "latest": {
    "version": "0.0.2",
    "date": "2026-10-07",
    "change": "The shared host reader (chock_scan) now refuses a name holding a letter whose lowercase Unicode 3.2 lacks (Georgian U+10A0-10C5, Cherokee U+13A0-13F4, U+04C0, U+2132, U+2183) on every Python. From CPython 3.12.15 (gh-155292, CVE-2026-17084) the stdlib IDNA2003 codec keeps those letters while the URL Standard lowercases them, so the two read two different hosts; older interpreters lowercased them and accepted the name. Such a name now gets the verdict for a host that cannot be read, the same on every interpreter."
  },
  "agent_labels": {
    "claude-code": {
      "keyword": "warn",
      "says": "warns on an agent's file writes and at turn end"
    },
    "cursor": {
      "keyword": "warn",
      "says": "warns on an agent's file writes and at turn end"
    },
    "codex": {
      "keyword": "warn",
      "says": "warns on an agent's file writes and at turn end. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)"
    },
    "copilot": {
      "keyword": "warn",
      "says": "warns at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)"
    },
    "devin": {
      "keyword": "warn",
      "says": "warns at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (vendor docs only, not witnessed)"
    },
    "grok": {
      "keyword": "ungraded",
      "says": "Not graded yet for Grok"
    },
    "goose": {
      "keyword": "ungraded",
      "says": "Not graded yet for goose"
    },
    "antigravity": {
      "keyword": "ungraded",
      "says": "Not graded yet for Antigravity"
    },
    "openhands": {
      "keyword": "ungraded",
      "says": "Not graded yet for OpenHands"
    },
    "kimi-code": {
      "keyword": "ungraded",
      "says": "Not graded yet for Kimi Code"
    },
    "factory-droid": {
      "keyword": "ungraded",
      "says": "Not graded yet for Factory Droid"
    }
  },
  "source_url": "https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/scan-hidden-content",
  "enforces": "advisory",
  "examples": [
    {
      "word": "Warns",
      "prompt": "A README gains a Markdown image whose query sends a token to an outside host.",
      "command": null
    },
    {
      "word": "Allowed",
      "prompt": "A README gains shields.io and GitHub Actions badges without a query.",
      "command": null
    }
  ]
}