cloakcheck

Fetch a URL and scan it for content planted to hijack an AI agent visiting it rather than to inform a human: invisible unicode (zero-width joiners, steganographic tag-block characters), CSS-hidden text (display:none, opacity:0, off-screen) paired with instruction-shaped language ('ignore previous instructions', 'add to cart and checkout', fake system-role text), and instruction-shaped phrases in alt/title/aria-label attributes or meta tags. Call this before an autonomous browsing or checkout flow acts on instructions found on a page. A clean result means no known hijack pattern found, not a full content-safety guarantee.

{'type': 'object', 'required': ['url'], 'properties': {'url': {'type': 'string', 'description': 'Full URL (http:// or https://) of the page to scan'}}}