--- id: scan-hidden-content track: coding version: 0.0.2 label: warns keyword: warn where: write turn-end sha256: faa2be8ec4e4bd1809939b900f8dfbcf29be4d7ce54ddd0f320ec5a6c92da3cf source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/scan-hidden-content catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f --- # Scan Hidden Content scan-hidden-content · version 0.0.2 Warns — Warns on an agent's file writes and at turn end. Chock adds friction. It is not a security boundary. In a git repo: advisory (The agent reads the text, and nothing stops a violation.) ## What it does Warns (observe) when a change adds text a reader cannot see, or a URL that carries data out, to Markdown, HTML, SVG, XML, Word, agent instruction files, docs and templates: instruction-like or long comments, CSS-hidden, white or 1pt text, hidden Word runs, URLs with secret words, long queries, placeholders or encoded parts, remote embeds, camo runs, HTML data URIs. Runs: commit, agent write, turn's end. Waiver: a person's marker comment line above. Friction, not a boundary. ## Its label on each agent - Claude Code (tested): Warns — Warns on an agent's file writes and at turn end. Builder: /coding/builder/#client=claude-code&p=scan-hidden-content - Cursor (tested): Warns — Warns on an agent's file writes and at turn end. Builder: /coding/builder/#client=cursor&p=scan-hidden-content - Codex (tested): Warns — Warns on an agent's file writes and at turn end. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=codex&p=scan-hidden-content - GitHub Copilot (tested): Warns — Warns at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=copilot&p=scan-hidden-content - Devin (tested): Warns — Warns at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (vendor docs only, not witnessed). Builder: /coding/builder/#client=devin&p=scan-hidden-content - Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=scan-hidden-content - goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=scan-hidden-content - Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=scan-hidden-content - OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=scan-hidden-content - Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=scan-hidden-content - Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=scan-hidden-content ## What it misses This policy does not state what it misses. ## Examples - Warns: A README gains a Markdown image whose query sends a token to an outside host. - Allowed: A README gains shields.io and GitHub Actions badges without a query. ## Latest change 0.0.2 · 2026-10-07 — The shared host reader (chock_scan) now refuses a name holding a letter whose lowercase Unicode 3.2 lacks (Georgian U+10A0-10C5, Cherokee U+13A0-13F4, U+04C0, U+2132, U+2183) on every Python. From CPython 3.12.15 (gh-155292, CVE-2026-17084) the stdlib IDNA2003 codec keeps those letters while the URL Standard lowercases them, so the two read two different hosts; older interpreters lowercased them and accepted the name. Such a name now gets the verdict for a host that cannot be read, the same on every interpreter. ## Provenance - Tested by 44 of 45 cases run automatically - SHA-256: `faa2be8ec4e4bd1809939b900f8dfbcf29be4d7ce54ddd0f320ec5a6c92da3cf` - Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f - Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/scan-hidden-content (catalog path `base/scan-hidden-content`) - Presets: Prompt injection and memory - JSON: `/api/coding/policies/scan-hidden-content.json` - Report a problem: https://chock.sh/report/?policy=scan-hidden-content&version=0.0.2&page=%2Fcoding%2Fpolicies%2Fscan-hidden-content%2F