raio-x-documental — Hidden Text & Prompt Injection Detector

What it does

Someone can hide instructions for your AI inside a document: white text on a white page, a 1-point font, invisible Unicode characters, a line in the metadata. A human reader sees nothing; the AI reads everything and may obey. This skill finds that content before the document reaches the AI.

It was built after a real case in a Brazilian court, where an expert witness hid a white-on-white command in his report telling the AI to agree with him.

How it works

• Compares what a person sees with what a machine reads, format by format.
• Deterministic and offline: no AI reads the hidden text during the analysis, and the file never leaves your computer.
• Hidden content plus a command addressed to an AI is rated CRITICAL.
• Never modifies the original. Optionally creates a sanitized copy (visible text only) and a decoded copy of the hidden content.

Formats: PDF (native and scanned), DOCX/DOC, ODT, RTF, TXT/MD, HTML/e-mail and images (PNG/JPG/TIFF/BMP/WEBP).

Output: a verdict in the terminal and a formal HTML/JSON report with the file's SHA-256 and the location and transcription of each finding. Folder mode checks every document in a folder and summarizes the suspicious ones.

What's included

• The full detection engine (Python) and the agent workflow for Claude Code, Codex and other SKILL.md agents.
• A license for professional use: law firms, consultancies, compliance teams, companies.

Good to know

• Requires Python 3.9+ and four pip packages; Tesseract OCR for images and scanned PDFs (with the Tesseract language pack of each script you scan).
• The formal report is in Brazilian Portuguese (Brazilian court standards). Your agent explains the results in your language.
• Hidden-text detection works in any language. Recognizes injection commands in 10 languages: English, Mandarin Chinese, Hindi, Spanish, French, Arabic, Bengali, Russian, Portuguese and Urdu.
• A "clean" verdict means no known vector was found, not an absolute guarantee.

Known limitations

• The injection-phrase lists are heuristics, written without review by native speakers.
• Urdu in Nastaliq fonts has weak OCR (Naskh works).
• In PDFs in Arabic, Hindi, Bengali or Urdu whose text layer is scrambled, the hidden text is flagged, but the command may not be recognized (the verdict is MEDIUM instead of CRITICAL).
• Hidden text in a non-Latin script with fewer than about 10 letters in an image may not be read.
• Scanned pages in non-Latin scripts take longer to process, because the OCR makes extra passes for those scripts.
• If the Tesseract language pack of a script is not installed, scanned documents in that script are not read. The tool does not stay silent: the result carries an INFO note naming the languages that were not checked (in the terminal, the report and the folder summary). The verdict itself is not changed, so it can still be clean. --doctor lists the 10 languages with ✓ or ✗.
• A legitimate correction notice with a visible polite request (for example "veuillez ignorer les instructions précédentes") can be rated HIGH, because it is the same sentence as the attack. The report transcribes the text and the person judges.
• The Chinese phrases and the Chinese OCR target Simplified characters; Traditional Chinese is only partly recognized.

Note for reviewers

This is a defensive detector. scripts/padroes_injecao.py contains regular expressions of known prompt-injection phrases in 10 languages (for example "ignore previous instructions") because the tool searches for them inside documents; they are detection patterns, not instructions. The only external program is the Tesseract OCR binary, called through subprocess.run with an argument list and without shell=True. There is no network access. The tool never writes to or modifies the analyzed file.