{
 "rulesVersion": "2026.11.2",
 "scoring": "Each finding adds its weight (x1.25 per repeat, up to x1.5). Findings in concealed channels count x1.6. Risk is capped at 100. clean < 20, suspicious 20-59, hostile >= 60.",
 "limits": [
  "Pattern rules are English-only heuristics and can be evaded by paraphrase.",
  "Hiding done with CSS classes or external stylesheets is not detected; only the hidden attribute and inline styles are.",
  "Text inside images, PDFs and scripts is not read.",
  "A page that quotes an injection (for example a security article) is flagged suspicious by design: quoted instructions are still instructions to a model."
 ],
 "patternRules": [
  {
   "rule": "override.ignore_previous",
   "category": "override",
   "weight": 45
  },
  {
   "rule": "override.new_instructions",
   "category": "override",
   "weight": 30
  },
  {
   "rule": "override.from_now_on",
   "category": "override",
   "weight": 25
  },
  {
   "rule": "role.you_are_now",
   "category": "role_hijack",
   "weight": 35
  },
  {
   "rule": "role.chat_markers",
   "category": "role_hijack",
   "weight": 40
  },
  {
   "rule": "agent.addressing",
   "category": "agent_addressing",
   "weight": 30
  },
  {
   "rule": "steer.output_marker",
   "category": "output_steering",
   "weight": 30
  },
  {
   "rule": "agent.summary_steering",
   "category": "agent_addressing",
   "weight": 25
  },
  {
   "rule": "secrecy.hide_from_user",
   "category": "secrecy",
   "weight": 40
  },
  {
   "rule": "exfil.send_secrets",
   "category": "exfiltration",
   "weight": 50
  },
  {
   "rule": "exfil.url_template",
   "category": "exfiltration",
   "weight": 45
  },
  {
   "rule": "tool.run_command",
   "category": "tool_abuse",
   "weight": 35
  },
  {
   "rule": "tool.invoke",
   "category": "tool_abuse",
   "weight": 30
  },
  {
   "rule": "encoded.decode_and_follow",
   "category": "encoded_payload",
   "weight": 30
  }
 ],
 "structuralRules": [
  {
   "rule": "unicode.tag_smuggling",
   "category": "invisible_text",
   "weight": 90,
   "detail": "Unicode tag characters (U+E0000 block) carrying a hidden ASCII message. Decoded and removed."
  },
  {
   "rule": "unicode.variation_selector_smuggling",
   "category": "invisible_text",
   "weight": 80,
   "detail": "Runs of variation selectors encoding hidden bytes. Decoded and removed."
  },
  {
   "rule": "unicode.bidi_controls",
   "category": "invisible_text",
   "weight": 15,
   "detail": "Bidirectional override characters that can reorder what a human sees. Removed."
  },
  {
   "rule": "unicode.zero_width",
   "category": "invisible_text",
   "weight": 10,
   "detail": "Zero-width characters (20 or more). Removed before matching so split words are still caught."
  },
  {
   "rule": "html.hidden_content",
   "category": "hidden_content",
   "weight": 0,
   "detail": "Text inside elements hidden with the hidden attribute or inline CSS. Removed from the markdown, still scanned."
  },
  {
   "rule": "html.comment",
   "category": "hidden_content",
   "weight": 0,
   "detail": "HTML comments are never returned. Reported only when they contain instruction patterns."
  },
  {
   "rule": "html.alt_text",
   "category": "hidden_content",
   "weight": 0,
   "detail": "Image alt text is dropped when it matches an instruction pattern."
  }
 ]
}