From 3b52b41b0e78fbd00e0d300b4902cb346a4c1360 Mon Sep 17 00:00:00 2001
From: Mykhailo Chalyi <mike@chaliy.name>
Date: Mon, 26 Oct 2026 23:49:02 +0000
Subject: [PATCH] feat(security): skip hidden content by default

Text a reader never sees is a prompt-injection vector for LLM consumers
(new threat T7).

- HTML: skip elements with hidden, aria-hidden="true", or inline
  display:none / visibility:hidden|collapse / opacity:0 / font-size:0,
  and <template>
- DOCX: skip w:vanish runs with a hidden_content_skipped warning
- include_hidden_content(true) opts back in
- Exclude selectors (and the hidden check) now apply to list items and
  table rows/cells, which previously bypassed them
---
 AGENTS.md                                |   2 +-
 CHANGELOG.md                             |   5 +
 crates/markkit/src/config.rs             |  13 +++
 crates/markkit/src/docx.rs               |  20 +++-
 crates/markkit/src/extract.rs            |   1 +
 crates/markkit/src/html/parser.rs        |  59 ++++++++++-
 crates/markkit/tests/hidden_content.rs   | 129 +++++++++++++++++++++++
 crates/markkit/tests/html_integration.rs |  12 +++
 knowledge/formats/format-support.md      |   3 +-
 knowledge/formats/html-extraction.md     |   8 ++
 knowledge/foundations/architecture.md    |   1 +
 knowledge/log.md                         |   1 +
 knowledge/operations/testing.md          |   1 +
 knowledge/security/index.md              |   2 +-
 knowledge/security/threat-model.md       |  28 ++++-
 15 files changed, 276 insertions(+), 9 deletions(-)
 create mode 100644 crates/markkit/tests/hidden_content.rs

diff --git a/AGENTS.md b/AGENTS.md
index 937d95f..ec192f1 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -31,7 +31,7 @@ Fix root cause. Unsure: read more code; if stuck, ask w/ short options. Unrecogn
 | formats/format-support | Formats, bytes-in API, detection order, DOCX + spreadsheet mapping |
 | integrations/tool-contract | `MarkkitTool` LLM tool (`tool` feature), Everruns toolkit contract |
 | security/security-model | One-page threat/invariant summary |
-| security/threat-model | Threats T1-T6, mitigations, test map, resource limits, invariants S1-S17 |
+| security/threat-model | Threats T1-T9, mitigations, test map, resource limits, invariants S1-S20 |
 | runtimes/python-package | PyO3 `markkit` module, maturin, PyPI |
 | runtimes/wasm-package | wasm-bindgen `@everruns/markkit-wasm`, browser/edge, build + tests |
 | runtimes/node-package | NAPI-RS `@everruns/markkit`, npm, binding parity table |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 924b255..6c44e70 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -106,6 +106,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 - The JSON IR of DOCX and spreadsheet tables now holds raw text (pipes were pre-escaped before).
 - Math TeX (taken from page markup) renders as code, GitHub's `` $`tex`$ `` and ` ```math `
   forms, instead of `$tex$` / `$$`, so it can no longer emit raw HTML or links in plain GFM.
+- Hidden content is skipped by default as a prompt-injection defence: HTML elements with `hidden`,
+  `aria-hidden="true"` or inline `display:none` / `visibility:hidden` / `opacity:0` / `font-size:0`,
+  `<template>`, and DOCX hidden (`w:vanish`) runs (warning `hidden_content_skipped`). Opt back in
+  with `include_hidden_content(true)`.
 
 ### Added
 
@@ -154,6 +158,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 - XLSX packages missing `_rels/.rels` no longer fail inside calamine.
 - Release builds use `panic = "unwind"`, so a parser panic becomes an error instead of aborting the
   CLI or the host Python/Node process.
+- Exclude selectors now apply to `<li>`, `<tr>`, `<th>` and `<td>`; they were ignored there.
 - Indented HTML (most real web pages) now keeps blank lines between blocks; previously
   headings, paragraphs, lists and tables after the first ran together with a leading space
   (`# A\n B` instead of `# A\n\nB`), which also broke headings and tables as markdown.
diff --git a/crates/markkit/src/config.rs b/crates/markkit/src/config.rs
index 85f428c..2881408 100644
--- a/crates/markkit/src/config.rs
+++ b/crates/markkit/src/config.rs
@@ -21,6 +21,10 @@ pub struct MarkkitBuilder {
     pub exclude_selectors: Vec<String>,
     /// Render hidden / very hidden sheets. Default: false (skipped with a warning).
     pub include_hidden_sheets: bool,
+    /// Render content a reader never sees: HTML `hidden`, `aria-hidden="true"`,
+    /// inline `display:none` / `visibility:hidden` / `opacity:0` / `font-size:0`,
+    /// and DOCX `w:vanish` runs. Default: false (prompt-injection vector, T9).
+    pub include_hidden_content: bool,
     /// Let `extract_url` reach loopback, private, link-local and other
     /// non-public addresses. Default: false (SSRF protection).
     pub allow_private_networks: bool,
@@ -63,6 +67,7 @@ impl Default for MarkkitBuilder {
                 "noscript".into(),
             ],
             include_hidden_sheets: false,
+            include_hidden_content: false,
             allow_private_networks: false,
             allowed_hosts: Vec::new(),
             base_url: None,
@@ -192,6 +197,14 @@ impl MarkkitBuilder {
         self
     }
 
+    /// Render hidden content (HTML hidden elements, DOCX hidden runs) instead of
+    /// skipping it. Hidden text is a prompt-injection vector; keep the default
+    /// (`false`) for content fed to LLMs.
+    pub fn include_hidden_content(mut self, yes: bool) -> Self {
+        self.include_hidden_content = yes;
+        self
+    }
+
     /// Allow `extract_url` to reach non-public addresses (loopback, RFC 1918,
     /// link-local, cloud metadata, ...). Only for trusted URLs.
     pub fn allow_private_networks(mut self, yes: bool) -> Self {
diff --git a/crates/markkit/src/docx.rs b/crates/markkit/src/docx.rs
index 9d0ee82..49f7bca 100644
--- a/crates/markkit/src/docx.rs
+++ b/crates/markkit/src/docx.rs
@@ -30,6 +30,7 @@ use crate::xml::{self, Element, XmlError};
 /// Result of parsing a DOCX package.
 pub(crate) struct DocxOutput {
     pub doc: Document,
+    pub warnings: Vec<String>,
     pub title: Option<String>,
     pub paragraphs: usize,
     pub tables: usize,
@@ -377,6 +378,10 @@ struct Ctx<'a> {
     styles: &'a Styles,
     numbering: &'a Numbering,
     budget: &'a Budget,
+    /// Render `w:vanish` runs (threat model T9).
+    include_hidden: bool,
+    /// Hidden runs skipped so far.
+    hidden_runs: std::cell::Cell<usize>,
 }
 
 impl Ctx<'_> {
@@ -415,7 +420,12 @@ impl Ctx<'_> {
     }
 
     fn run_segs(&self, run: &Element, link: Option<&str>, segs: &mut Vec<Seg>) {
-        let fmt = run_fmt(run.child("rPr"));
+        let rpr = run.child("rPr");
+        if !self.include_hidden && toggle_on(rpr.and_then(|r| r.child("vanish"))) {
+            self.hidden_runs.set(self.hidden_runs.get() + 1);
+            return;
+        }
+        let fmt = run_fmt(rpr);
         let link = link.map(str::to_string);
         let push_text = |segs: &mut Vec<Seg>, t: String| {
             segs.push(Seg::Text {
@@ -966,6 +976,8 @@ pub(crate) fn parse(
         styles: &styles,
         numbering: &numbering,
         budget,
+        include_hidden: config.include_hidden_content,
+        hidden_runs: std::cell::Cell::new(0),
     };
     let mut body = Body {
         track: config.track_sources,
@@ -980,6 +992,12 @@ pub(crate) fn parse(
         paragraphs: body.paragraphs,
         tables: body.tables,
         doc: Document::new(body.blocks),
+        warnings: match ctx.hidden_runs.get() {
+            0 => Vec::new(),
+            n => vec![format!(
+                "hidden_content_skipped: {n} hidden text run(s) skipped"
+            )],
+        },
     })
 }
 
diff --git a/crates/markkit/src/extract.rs b/crates/markkit/src/extract.rs
index f2f9608..be2dbfb 100644
--- a/crates/markkit/src/extract.rs
+++ b/crates/markkit/src/extract.rs
@@ -391,6 +391,7 @@ impl Markkit {
         self.config.transforms.apply(&mut doc)?;
         let mut p = ParsedDocument::new(doc, Format::Docx);
         p.title = out.title;
+        p.warnings = out.warnings;
         p.stats.paragraphs = Some(out.paragraphs);
         p.stats.tables = Some(out.tables);
         Ok(p)
diff --git a/crates/markkit/src/html/parser.rs b/crates/markkit/src/html/parser.rs
index 4abf193..f6c385c 100644
--- a/crates/markkit/src/html/parser.rs
+++ b/crates/markkit/src/html/parser.rs
@@ -39,6 +39,45 @@ use url::Url;
 use super::metadata::PageInfo;
 use super::{readability, urls};
 
+/// Hidden-content policy (threat model T9): an element a reader never sees is
+/// skipped unless `include_hidden_content(true)`. Only signals on the element
+/// itself count (`hidden`, `aria-hidden="true"`, inline `style`); stylesheet and
+/// class-based hiding (`.sr-only`, off-screen positioning) is not detected.
+fn is_hidden(el: &scraper::node::Element) -> bool {
+    if el
+        .attr("hidden")
+        .is_some_and(|v| !v.eq_ignore_ascii_case("until-found"))
+    {
+        return true;
+    }
+    if el
+        .attr("aria-hidden")
+        .is_some_and(|v| v.trim().eq_ignore_ascii_case("true"))
+    {
+        return true;
+    }
+    let Some(style) = el.attr("style") else {
+        return false;
+    };
+    style.split(';').any(|decl| {
+        let Some((prop, value)) = decl.split_once(':') else {
+            return false;
+        };
+        let prop = prop.trim().to_ascii_lowercase();
+        let value = value.to_ascii_lowercase();
+        let value = value.trim().trim_end_matches("!important").trim();
+        match prop.as_str() {
+            "display" => value == "none",
+            "visibility" => value == "hidden" || value == "collapse",
+            "opacity" | "font-size" => {
+                let num = value.trim_end_matches(|c: char| c.is_ascii_alphabetic() || c == '%');
+                num.parse::<f64>().is_ok_and(|n| n == 0.0)
+            }
+            _ => false,
+        }
+    })
+}
+
 /// Outcome of a matching element rule.
 enum RuleHit {
     Skip,
@@ -271,6 +310,7 @@ impl<'a> HtmlParser<'a> {
     fn is_excluded(&self, el: &scraper::ElementRef<'_>, exclude: &[Selector]) -> bool {
         exclude.iter().any(|sel| sel.matches(el))
             || (self.drop_unlikely.get() && readability::is_unlikely(*el))
+            || (!self.config.include_hidden_content && is_hidden(el.value()))
     }
 
     fn convert_children(
@@ -569,9 +609,9 @@ impl<'a> HtmlParser<'a> {
             "hr" => Some(Node::ThematicBreak),
 
             // Skip non-content elements
-            "script" | "style" | "noscript" | "iframe" | "object" | "embed" | "form" | "input"
-            | "button" | "select" | "textarea" | "svg" | "canvas" | "video" | "audio"
-            | "source" | "track" | "map" | "area" => None,
+            "script" | "style" | "noscript" | "template" | "iframe" | "object" | "embed"
+            | "form" | "input" | "button" | "select" | "textarea" | "svg" | "canvas" | "video"
+            | "audio" | "source" | "track" | "map" | "area" => None,
 
             // Unknown element: try to extract inline content
             _ => {
@@ -967,6 +1007,7 @@ impl<'a> HtmlParser<'a> {
         for child in list_el.children() {
             if let Some(el) = scraper::ElementRef::wrap(child)
                 && el.value().name() == "li"
+                && !self.is_excluded(&el, exclude)
             {
                 let mut children = Vec::new();
                 self.convert_children(el, exclude, &mut children, depth + 1);
@@ -1026,6 +1067,9 @@ impl<'a> HtmlParser<'a> {
             };
 
         for tr in body_rows {
+            if self.is_excluded(&tr, exclude) {
+                continue;
+            }
             let row = row_cells(tr, &["td", "th"]);
             // A leading all-<th> row is the header.
             if headers.is_empty()
@@ -1080,7 +1124,14 @@ impl<'a> HtmlParser<'a> {
                 n.min(MAX_ROWSPAN)
             }
         });
-        TableCell::new(self.collect_inline(cell, exclude, depth + 1)).with_span(colspan, rowspan)
+        // An excluded or hidden cell stays as an empty cell so columns keep
+        // their alignment.
+        let children = if self.is_excluded(&cell, exclude) {
+            Vec::new()
+        } else {
+            self.collect_inline(cell, exclude, depth + 1)
+        };
+        TableCell::new(children).with_span(colspan, rowspan)
     }
 }
 
diff --git a/crates/markkit/tests/hidden_content.rs b/crates/markkit/tests/hidden_content.rs
new file mode 100644
index 0000000..4518468
--- /dev/null
+++ b/crates/markkit/tests/hidden_content.rs
@@ -0,0 +1,129 @@
+//! Hidden content (threat model T9): text a human reader never sees is a
+//! prompt-injection vector, so it is skipped unless `include_hidden_content(true)`.
+
+#[cfg(feature = "docx")]
+mod common;
+
+#[cfg(feature = "html")]
+mod html {
+    use markkit::Markkit;
+
+    fn convert(html: &str) -> String {
+        Markkit::builder().build().extract_html_sync(html).unwrap()
+    }
+
+    fn convert_all(html: &str) -> String {
+        Markkit::builder()
+            .include_hidden_content(true)
+            .build()
+            .extract_html_sync(html)
+            .unwrap()
+    }
+
+    const HIDDEN: &[&str] = &[
+        r#"<div style="display:none">INJECT</div>"#,
+        r#"<div style="DISPLAY : None !important">INJECT</div>"#,
+        r#"<p style="color:red;visibility:hidden">INJECT</p>"#,
+        r#"<span style="visibility: collapse">INJECT</span>"#,
+        r#"<span style="font-size:0">INJECT</span>"#,
+        r#"<span style="font-size: 0px">INJECT</span>"#,
+        r#"<span style="opacity:0">INJECT</span>"#,
+        r#"<span style="opacity: 0.0">INJECT</span>"#,
+        r#"<div hidden>INJECT</div>"#,
+        r#"<div aria-hidden="true">INJECT</div>"#,
+        r#"<template><p>INJECT</p></template>"#,
+        r#"<p>visible <span style="display:none">INJECT</span> text</p>"#,
+        r#"<ul><li style="display:none">INJECT</li><li>visible</li></ul>"#,
+        r#"<table><tr><td>a</td><td style="display:none">INJECT</td></tr></table>"#,
+    ];
+
+    #[test]
+    fn hidden_elements_skipped_by_default() {
+        for html in HIDDEN {
+            let md = convert(&format!("<p>visible</p>{html}"));
+            assert!(!md.contains("INJECT"), "{html} -> {md:?}");
+            assert!(md.contains("visible"), "{html} -> {md:?}");
+        }
+    }
+
+    #[test]
+    fn hidden_elements_kept_when_opted_in() {
+        for html in HIDDEN.iter().filter(|h| !h.starts_with("<template")) {
+            let md = convert_all(html);
+            assert!(md.contains("INJECT"), "{html} -> {md:?}");
+        }
+    }
+
+    #[test]
+    fn visible_styles_are_not_hidden() {
+        for html in [
+            r#"<p style="display:block">SHOWN</p>"#,
+            r#"<p style="opacity:0.5">SHOWN</p>"#,
+            r#"<p style="font-size:10px">SHOWN</p>"#,
+            r#"<p style="font-size:0.9em">SHOWN</p>"#,
+            r#"<p aria-hidden="false">SHOWN</p>"#,
+            r#"<p hidden="until-found">SHOWN</p>"#,
+            r#"<p class="hidden sr-only">SHOWN</p>"#,
+            r#"<p data-style="display:none">SHOWN</p>"#,
+        ] {
+            let md = convert(html);
+            assert!(md.contains("SHOWN"), "{html} -> {md:?}");
+        }
+    }
+}
+
+#[cfg(feature = "docx")]
+mod docx {
+    use super::common::*;
+    use markkit::{DocumentHint, Markkit};
+
+    fn run(props: &str, text: &str) -> String {
+        format!("<w:r><w:rPr>{props}</w:rPr><w:t>{text}</w:t></w:r>")
+    }
+
+    fn md(body: &str, include: bool) -> markkit::Extraction {
+        Markkit::builder()
+            .include_hidden_content(include)
+            .build()
+            .extract_document_sync(&docx(body), DocumentHint::file_name("a.docx"))
+            .unwrap()
+    }
+
+    #[test]
+    fn vanish_runs_skipped_by_default() {
+        let body = format!(
+            "<w:p>{}{}</w:p><w:p>{}</w:p>",
+            run("", "shown "),
+            run("<w:vanish/>", "INJECT"),
+            run("<w:vanish w:val=\"true\"/>", "INJECT2"),
+        );
+        let e = md(&body, false);
+        assert_eq!(e.markdown, "shown\n");
+        assert!(
+            e.warnings
+                .iter()
+                .any(|w| w.starts_with("hidden_content_skipped")),
+            "{:?}",
+            e.warnings
+        );
+    }
+
+    #[test]
+    fn vanish_off_is_visible() {
+        let e = md(
+            &format!("<w:p>{}</w:p>", run("<w:vanish w:val=\"0\"/>", "shown")),
+            false,
+        );
+        assert_eq!(e.markdown, "shown\n");
+        assert!(e.warnings.is_empty());
+    }
+
+    #[test]
+    fn vanish_runs_kept_when_opted_in() {
+        let e = md(
+            &format!("<w:p>{}</w:p>", run("<w:vanish/>", "secret")),
+            true,
+        );
+        assert_eq!(e.markdown, "secret\n");
+    }
+}
diff --git a/crates/markkit/tests/html_integration.rs b/crates/markkit/tests/html_integration.rs
index f313e51..1d65a47 100644
--- a/crates/markkit/tests/html_integration.rs
+++ b/crates/markkit/tests/html_integration.rs
@@ -363,6 +363,18 @@ fn include_selector() {
     assert!(!md.contains("Sidebar"));
 }
 
+#[test]
+fn exclude_selector_applies_to_list_items_and_table_parts() {
+    let html = r#"<ul><li class="ad">AD</li><li>keep</li></ul>
+<table><tr><th>h1</th><th>h2</th></tr><tr class="ad"><td>AD</td><td>AD</td></tr>
+<tr><td class="ad">AD</td><td>cell</td></tr></table>"#;
+    let md = convert_with(html, |b| b.exclude_selector(".ad"));
+    assert!(!md.contains("AD"), "{md}");
+    assert!(md.contains("- keep"), "{md}");
+    // Excluded cell stays as an empty cell so columns keep alignment.
+    assert!(md.contains("|  | cell |"), "{md}");
+}
+
 #[test]
 fn exclude_selector_custom() {
     let html = r#"<p>Keep this</p><div class="ad">Buy stuff</div><p>And this</p>"#;
diff --git a/knowledge/formats/format-support.md b/knowledge/formats/format-support.md
index 1d090a3..c464f4a 100644
--- a/knowledge/formats/format-support.md
+++ b/knowledge/formats/format-support.md
@@ -76,7 +76,7 @@ only the Markdown. Parsing is CPU-bound; async callers should use the sync varia
 `spawn_blocking`.
 
 Warning codes: `truncated_sheet`, `hidden_sheet_skipped`, `sheet_error`, `truncated_pdf`,
-`pdf_unmapped_font`, `pdf_no_text`, `invalid_utf8`.
+`pdf_unmapped_font`, `pdf_no_text`, `invalid_utf8`, `hidden_content_skipped`.
 
 ## Format Detection
 
@@ -113,6 +113,7 @@ mislabelled as another Excel type still parses.
 | `w:br` / `w:cr` | Hard line break (page/column breaks ignored); `w:tab` → space |
 | `w:ins`, `w:sdt`, `w:smartTag`, `w:customXml`, `w:fldSimple` | Unwrapped |
 | `w:del`, `w:instrText`, drawings/text boxes, comments, headers/footers, footnotes | Skipped |
+| Runs with direct `w:vanish` (hidden text) | Skipped with `hidden_content_skipped` unless `include_hidden_content(true)` |
 
 The main part is located through `_rels/.rels` (fallback `word/document.xml`); styles and
 numbering through the main part's relationships.
diff --git a/knowledge/formats/html-extraction.md b/knowledge/formats/html-extraction.md
index 8e60802..f770e9d 100644
--- a/knowledge/formats/html-extraction.md
+++ b/knowledge/formats/html-extraction.md
@@ -155,6 +155,14 @@ are skipped entirely (no children processed).
 Note: `script`, `style`, `noscript` are also in the non-content element list in the parser,
 providing defense-in-depth.
 
+## Hidden Content
+
+Elements a reader never sees are skipped by default (threat model T9): `hidden`
+(except `until-found`), `aria-hidden="true"`, inline `display:none`,
+`visibility:hidden|collapse`, `opacity:0`, `font-size:0`, and `<template>`.
+`include_hidden_content(true)` renders them. Exclude selectors and the hidden check
+also apply to `<li>`, `<tr>`, `<th>` and `<td>`; an excluded cell renders empty.
+
 ## Content Extraction Strategies
 
 - **CSS selectors** (implemented): include/exclude selectors, with the defaults below
diff --git a/knowledge/foundations/architecture.md b/knowledge/foundations/architecture.md
index 11701bb..300f7a3 100644
--- a/knowledge/foundations/architecture.md
+++ b/knowledge/foundations/architecture.md
@@ -68,6 +68,7 @@ Via `MarkkitBuilder`:
 - CSS selectors for include/exclude
 - Link and image preservation
 - Office-document limits (archive entries/sizes, sheet rows/cols, grid cells, hidden sheets)
+- Hidden content (`include_hidden_content`, default off): HTML hidden elements, DOCX hidden runs
 - URL fetch policy (`allow_private_networks`, `allow_host`, `max_redirects`)
 - Base URL for relative links, images and metadata URLs (`base_url`)
 - Provenance (`track_sources`): per-block `Source` in the IR (off by default)
diff --git a/knowledge/log.md b/knowledge/log.md
index 3f80aa1..6c58dd7 100644
--- a/knowledge/log.md
+++ b/knowledge/log.md
@@ -9,6 +9,7 @@
 
 ## 2026-10-26
 
+* **Hidden content**: new threat T9 (prompt injection via text a reader never sees). HTML hidden elements and DOCX `w:vanish` runs are skipped unless `include_hidden_content(true)`; exclude selectors now also apply to list items and table rows/cells, which previously bypassed them. Invariant S20. See [Threat Model](security/threat-model.md) and [HTML Extraction](formats/html-extraction.md).
 * **Element rules**: declarative `HtmlRule { selector, action }` (`MarkkitBuilder::html_rule`, CLI `--rules`) tried before built-in HTML mapping; invalid selectors error. See [HTML Extraction](formats/html-extraction.md).
 * **Output safety**: the renderer escaped nothing, so document text could emit raw HTML, links, headings and fence breakouts, and `javascript:` links passed through. Escaping and a URL scheme allowlist now live in `render/escape.rs`; DOCX and spreadsheet parsers stop pre-escaping table pipes, so the IR holds raw text. New invariant S17 with a pulldown-cmark oracle. A first fuzzing pass against that oracle found eight more container breakouts (list indentation by marker width, blocks in inline context, adjacent code spans, nested links, ...), all fixed. Math now renders as code (`` $`tex`$ ``, ` ```math `) because TeX from page markup reached plain-GFM output unescaped. See [Threat Model](security/threat-model.md) T1.
 * **Main content**: opt-in Readability-style detection (`main_content`, CLI `--main-content`) keeps the article body and drops sidebars, comments, share bars; falls back to the full body when nothing scores. Algorithm in [HTML Extraction](formats/html-extraction.md); bounds in [Threat Model](security/threat-model.md) T2g.
diff --git a/knowledge/operations/testing.md b/knowledge/operations/testing.md
index 40e2a99..d3f2dfe 100644
--- a/knowledge/operations/testing.md
+++ b/knowledge/operations/testing.md
@@ -17,6 +17,7 @@ tags:
 | `crates/markkit/tests/html_integration.rs` | End-to-end HTML to markdown |
 | `crates/markkit/tests/html_fixtures.rs` | Golden files: `tests/fixtures/html/<name>.html` vs `<name>.md` |
 | `crates/markkit/tests/html_security.rs` | XSS payloads, nesting, oversized input |
+| `crates/markkit/tests/hidden_content.rs` | Hidden HTML elements and DOCX `w:vanish` runs skipped by default (T9) |
 | `crates/markkit/tests/output_safety.rs` | Renderer escaping, URL scheme allowlist, fences; pulldown-cmark oracle + proptests |
 | `crates/markkit/tests/html_proptest.rs` | Property tests: no panic, no script/style, determinism, limits |
 | `crates/markkit/tests/docx_integration.rs`, `spreadsheet_integration.rs` | Office mapping |
diff --git a/knowledge/security/index.md b/knowledge/security/index.md
index 6c46f54..44cb31a 100644
--- a/knowledge/security/index.md
+++ b/knowledge/security/index.md
@@ -1,4 +1,4 @@
 # Security
 
 * [Security Model](security-model.md) - Threat categories and security invariants summary for untrusted document input.
-* [Threat Model](threat-model.md) - Attack surface, threats T1-T6 with mitigations and test coverage, resource limits, and security invariants.
+* [Threat Model](threat-model.md) - Attack surface, threats T1-T9 with mitigations and test coverage, resource limits, and security invariants.
diff --git a/knowledge/security/threat-model.md b/knowledge/security/threat-model.md
index d0f18e7..5a2c934 100644
--- a/knowledge/security/threat-model.md
+++ b/knowledge/security/threat-model.md
@@ -1,7 +1,7 @@
 ---
 type: Threat Model
 title: Threat Model
-description: Attack surface, threats T1-T7 with mitigations and test coverage, resource limits, and security invariants.
+description: Attack surface, threats T1-T9 with mitigations and test coverage, resource limits, and security invariants.
 tags:
   - markkit
   - security
@@ -397,6 +397,31 @@ decompression or content amplification, crashing the parser, or hiding text.
 - No file system paths in errors
 - No internal state exposed
 
+### T9: Hidden-Content Prompt Injection
+
+**Description**: Text a human reviewer never sees (CSS-hidden HTML, `aria-hidden`
+blocks, zero-size or transparent text, Word hidden runs) carries instructions aimed
+at an LLM that consumes the extracted Markdown.
+
+**Impact**: Medium-High -- downstream agents act on attacker instructions.
+
+**Likelihood**: High for web content fed to agents.
+
+**Mitigations** (skipped unless `include_hidden_content(true)`):
+- HTML: elements with `hidden` (not `until-found`), `aria-hidden="true"`, or an
+  inline `style` declaring `display:none`, `visibility:hidden|collapse`,
+  `opacity:0` or `font-size:0`; `<template>` always. Applies to list items, table
+  rows and cells too (a hidden cell stays empty to keep column alignment).
+- DOCX: runs with direct `w:vanish`; `hidden_content_skipped` warning with a count.
+- Spreadsheets: hidden sheets already skipped (T6e).
+
+**Residual**: hiding through stylesheets or classes (`.sr-only`, off-screen
+positioning, white-on-white via CSS), and `w:vanish` inherited from a character
+style, is not detected.
+
+**Test Coverage**: `hidden_content::*`,
+`html_integration::exclude_selector_applies_to_list_items_and_table_parts`
+
 ## Resource Limits
 
 | Resource | Default | Configurable | Enforcement Point |
@@ -466,6 +491,7 @@ decompression or content amplification, crashing the parser, or hiding text.
 | S17 | Rendered markdown has no raw HTML, no non-allowlisted link/image scheme, and document text cannot create Markdown structure | `output_safety::*` (pulldown-cmark oracle + proptests) |
 | S18 | Text and Markdown output never contains C0 controls (except tab/newline); Markdown raw HTML (blocks, inline tags) is never copied | `text_integration::security_*` |
 | S19 | No PDF stream is decoded past `max_pdf_stream_size`, by markkit or hayro | `pdf_security::*bomb*`, `pdf_security::chained_filters_are_measured_after_every_stage` |
+| S20 | Hidden content is not rendered by default | `hidden_content::*` |
 
 ## See also