Open source · a Chrome extension that scans on click and makes no network calls.

View source
CloakScan
ai-automation-tools · Chrome extension

Check the page for text you can't see but the AI agent can.

A page can carry instructions meant for a model and hidden from you: white text on white, a div parked 9,999 pixels off-screen, a 1px font, an HTML comment. CloakScan outlines each one on the page, lists it in plain language, and can copy the page's visible text with the hidden parts stripped.

What it detects

Six ways to hide text from a reader

Each detector is a structural check on the page you're on. The detection test runs all six against a fixture page in headless Chromium.

Color-matched text

Contrast between the text and its nearest background under 1.15:1.

contrast < 1.15:1

Off-screen positioning

Absolutely or fixed-positioned and more than 200px outside the viewport.

> 200px off-screen

Shrunk to invisible

A font size of 1px or less, or a 1x1 box with overflow hidden.

≤ 1px

Hidden from screen readers

aria-hidden="true" on text addressed to a model or overriding one. The phrasing rule is ADR-003; English only.

aria-hidden

HTML comments

Comments carrying the same instruction phrasing.

<!-- -->

Zero-width characters

U+200B, U+200C, U+200D, U+FEFF or U+2060 inside ordinary text.

U+200B · U+FEFF
How it works

Click, scan, copy what you read

Three clicks. Nothing runs before the first one.

  1. Click the CloakScan toolbar icon on the tab you want checked.
  2. Click Scan this page. Each finding is outlined on the page and listed in the popup in plain language.
  3. Copy the page's visible text with the flagged parts stripped, then paste only what you actually read.
Trust

Small permissions, nothing leaves the browser

Three permissions

activeTab, scripting and storage. No host_permissions, no background script.

No network calls

A test fails if any file in the extension contains fetch(, XMLHttpRequest, WebSocket, sendBeacon or EventSource.

Nothing collected

The last scan stays in chrome.storage.local on your device. Nothing is sent anywhere. Read the privacy policy.

Get started

Load it unpacked

Node 22 or newer. To try it without installing anything, open the live demo.

bash
# 1. Install dev dependencies
$ npm install

# 2. Copy the extension into dist/extension/
$ npm run build

# 3. In Chrome: chrome://extensions, turn on Developer mode,
#    Load unpacked, pick dist/extension/

# 4. Tests and lint (headless Chromium, installed once)
$ npx playwright install chromium
$ npm test && npm run lint

Not in the Chrome Web Store yet. This is the working prototype, loadable unpacked. The store package is next on the roadmap.

Resources

Everything is in the repo