Module security 

Secure Ingestion: defensive layer for content fetched from the open web before it is passed to an LLM agent.

Threat model

Public web pages can carry instructions, semantic data, and intercom addresses aimed at AI agents in layers that humans never read: HTML comments addressed to “machine intelligence”, machine-only attribute payloads (data-dim, data-ai-*, …), class="m"-style “machine” spans, display:none text, and aria-hidden="true" content. Whether the publisher is honest (semantic web research) or hostile (supply-chain attack), the agent reading the page cannot tell the difference from the markup alone.

Defensive treatment is the same regardless of intent: detect the channel, surface its provenance, and strip it by default before the agent reads the page. Operators can opt back in when they want the machine-readable layer.

See ingestion_guard for the detector + sanitiser. WebMCP advertisement detection is informational by default and can be made strict with NAB_WEBMCP_STRICT=true plus an explicit NAB_WEBMCP_OPT_IN allow-list.

Re-exports

pub use fetch_yara::guard_fetch_output;

pub use fetch_yara::guard_fetch_output_with_config;

pub use ingestion_guard::DetectionReport;

pub use ingestion_guard::DirectiveKind;

pub use ingestion_guard::IngestionGuardError;

pub use ingestion_guard::IngestionPolicy;

pub use ingestion_guard::Sample;

pub use ingestion_guard::Severity;

pub use ingestion_guard::detect;

pub use ingestion_guard::enforce_policy;

pub use ingestion_guard::sanitize;

pub use ingestion_guard::sanitize_with_env_policy;

pub use ingestion_guard::sanitize_with_policy;

Modules

fetch_yara

Fetch-time YARA-X guard integration.

ingestion_guard

Detect and strip machine-targeted markup from HTML.

yara_engine

YARA-X fetch-time guard for prompt-injection and exfiltration content.