Check H15 · agent family · severity CRITICAL · automatic · one of the 18 Hugging Face checks
The question this check asks: do the files an AI coding agent reads at the start of a session from this model, dataset or Space — CLAUDE.md, AGENTS.md, .cursorrules, an MCP configuration — contain characters that render as nothing?
H15 is the same detection function as GitHub's C19, run against the Hub's file list instead of a git tree. Code review is a visual process, and these files are written to be skimmed regardless of which platform hosts them. The Rules File Backdoor, published by Pillar Security in March 2025, puts instructions inside an agent's rules file using codepoints that occupy no visible space — zero-width joiners, bidirectional overrides, the Unicode Tags block. A reviewer skimming the file on the Hub's own file viewer sees ordinary guidance; the agent reading it does what the hidden text says. The technique needs no vulnerability, only a file a person skims and an agent obeys, and nothing about that mechanism is specific to where the file is hosted — a CLAUDE.md committed to a Space repository is read by an agent the same way one committed to a GitHub repository is.
The files that fit that description are named by H14, the presence check this one follows: on GitHub, Phase 0 controls found 77 of the 80 most popular repositories carried an agent instruction file, which is why having one costs nothing and what is inside it is the check.
H15 fetches the agent files a repository ships — the same set H14 names: CLAUDE.md, AGENTS.md, .cursorrules, .clinerules, .windsurfrules, .github/copilot-instructions.md, .cursor/rules/*.mdc, .mcp.json, .cursor/mcp.json and the .claude/ settings files — and scans each for codepoints in U+200B–U+200F, U+202A–U+202E, U+2060–U+2064, U+2066–U+2069, U+FEFF and U+E0000–U+E007F, exactly the range C19 scans for. Any hit is CRITICAL, costs 45 points, and makes the verdict BLOCK — because any CRIT finding drives the score to 0 regardless of what else the roster found. The finding names the file, the count and the codepoint names, and never the decoded text. The scoring engine's shared evidence note for H14–H17: “same functions/penalties as C18–C21 — reuse those check pages' scoring language, applied to the HF file list instead of the GitHub one.” C19's own note is more specific still — “Rules File Backdoor; zero FPs observed” — and H15 inherits that same weight for the same reason: the payload and the detection logic do not change when the file is fetched from huggingface.co instead of api.github.com.
None observed on the file sets this check has actually scanned. The GitHub-side measurement C19 cites — 80 popular, 50 young and 20 binary-shipping control repositories, zero hits — is a GitHub-only number and we do not claim it for the Hub. What the 12 September 2026 measurement of the top 100 most-downloaded Hugging Face models does confirm: it recorded 0 BLOCK results across all 100 repositories, and because any CRIT finding forces the score to 0 and the verdict to BLOCK, that result rules out an H15 hit — along with any other CRIT row — firing on any of them. H15 fired 0 times in that measurement. The one case C19 flags as its expected eventual false positive — a byte-order mark, U+FEFF, at the top of a file saved by a Windows editor — applies here without change, since it is a property of the file content, not the hosting platform.
It scans the files on the list. A rules file under a name we do not know, or one added to the repository after you downloaded it, is not read. It looks for invisible characters: homoglyphs — letters from another script that look like Latin ones — are a different technique and are not caught here, and neither is an instruction hidden in plain, readable prose that a reviewer would have to think about rather than see. And it reads the repository's files, not your agent's own configuration outside it.
And RepoGates as a whole gates browser downloads only — it does not see git clone, package managers, curl, huggingface_hub, or fetches made by AI agents outside the browser; a Python from_pretrained() call is never a shell line any hook sees. A rules file that reaches your machine by clone or by the Hub's Python client is not seen by this check; the tools in the next section run on a checkout and are the right answer there. This page, like every check page, exposes no globals a script running on it could read.
Without installing anything: open the file on the Hub's file viewer — GitHub's warning for bidirectional characters does not have an exact Hub equivalent, so this is one place a manual scan earns its keep more than on GitHub. Fetch the raw file and scan it from a terminal:
curl -s https://huggingface.co/ORG/NAME/raw/main/CLAUDE.md \
| perl -ne 'print "$.: $_" if /[\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2060}-\x{2064}\x{2066}-\x{2069}\x{FEFF}\x{E0000}-\x{E007F}]/'For a dataset or Space repository, swap the URL path accordingly — the Hub serves raw files at the same /ORG/NAME/raw/main/PATH shape for every repository kind. The open-source anti-trojan-source scanner and SonarQube's rules S6389 and S7628 cover the same codepoints and run equally well on a Hub checkout; this check runs before the download.
This model ships a CLAUDE.md — does that fire H15? No, not on its own. Having an agent instruction file is check H14, scored at 0 points for the same reason it is on GitHub's C18. H15 reads what is inside the file and fires only on codepoints that render as nothing: zero-width characters, bidirectional overrides, invisible operators, the Unicode Tags block.
Can I see what was hidden? Not from the finding, deliberately. It names the file, the number of invisible codepoints and their Unicode names — never the decoded text, because rendering a hidden instruction into a report moves the payload to a second surface. Open the file in an editor that shows codepoints, or run the one-line scan on this page against the Hub's raw file URL.
Does RepoGates stop a git clone or huggingface_hub download? No. RepoGates gates browser-initiated downloads only. It does not see git clone, huggingface_hub, huggingface-cli, curl, or a Python from_pretrained() call. A rules file that reaches your machine by any of those paths is not seen by this check.
H14 Agent config files — the files this check reads; presence alone is 0 points · H16 MCP shell-launch config — the same files, a different payload: a command that fetches and runs · H18 AI-agent provenance — a repository carrying instructions for an agent, and (once it ships) surfaced by one · C19 Hidden Unicode (GitHub) — the same function, reading a git tree instead of the Hub's file list.
Add RepoGates to Chrome Pricing
Numbers on this page: Pillar Security, March 2025 (the technique); GitHub Phase 0 controls of 2026-08-14 (150 repositories, zero hits; 77/80 carrying agent files); the 12 September 2026 measurement of the top 100 most-downloaded Hugging Face models (0 BLOCK, 28 REVIEW, 72 PASS), published on the malicious models intelligence page; weights from the product's scoring table; codepoint ranges from the repository vetting standard.