What the seal checks — and what it does not
Every version of every item is scanned before it can be published. This page is the public specification. The shorter explainer is on About.
The four stages
Invisible Unicode
Zero-width characters, bidirectional overrides, and other invisible format marks that a human review can miss while a model still reads them.
On detection: Fail (auto-quarantine). Non-NFC / homoglyph smell is info.
Prompt injection
Instruction-override phrasing, role hijacks, covert-channel directives (“do not tell the user”), including spacing evasion. Ordinary role-play is not flagged.
On detection: Fail in rules, agent instructions, and skills; warn on prompts.
Exfiltration sinks
Markdown images whose URL carries query data, beacon / request-capture hosts, templated query strings, and active-content data: URIs.
On detection: Fail on data-carrying and beacon URLs; warn on variable-built queries and raw public IPs.
Embedded secrets
Cloud keys, GitHub and model-provider tokens, Slack tokens, private-key blocks. Placeholder-shaped values are excluded. Public excerpts are redacted.
On detection: Fail on known credential shapes; warn on generic hard-coded assignments.
Verdicts and lifecycle
- Fail — auto-quarantined into human review. Never public until a person releases it. Quarantines are audited.
- Warn — published with every finding on the public scan report.
- Pass — no known mechanical attack patterns at the recorded scanner version. The badge links to the full report.
- Every edit creates a new immutable version and a mandatory re-scan. A published item whose new version fails is pulled back. When stages improve, the catalog is re-scanned.
Honest limits
A cleverly worded malicious instruction in plain language — no hidden characters, no trigger phrasing, no URLs, no secrets — can pass. The scanner does not judge whether advice is good, and it never executes or fetches anything. A pass badge is a strong filter against known mechanical attack classes, not a guarantee. Review files before giving them to an agent with real permissions.
Reporting
Found something the scanner missed, or a false positive? Use the Report form on any item page (no account needed), or email security@waxmark.app. Confirmed false negatives become corpus fixtures so the gap stays closed.