Content screening
Web text and new skills are checked for injection phrasing and hidden text. Web text gets a warning banner. Skills are rejected. Logs and reports are redacted.
Content guard
Looks for phrases such as ignore previous instructions, hidden HTML comments, invisible characters and instructions to send data to a URL. Scans up to 20,000 characters after Unicode normalisation.
Privacy redaction
Removes authorization headers, cookies, URL credentials, token shapes and key=value secrets. Used for the event log, GitHub reports and progress previews. Capped at 8,000 characters.
Limits
Pattern lists miss new phrasing. A banner does not stop the model from following text.
See also:Threat model
Checked against the source at commit f4fd89f on 29 Oct 2026. Everything here is merged on the main branch; no release has been tagged yet. The source is private, so these pages are the public description.