Guardio Labs · Extension Sensor Lab

puppys.click KB Sensor Test Fixture

All 4 sensors scoped to puppys.click only — eval_hook, shadow_dom_patch_research, shadow_dom_kb_collection_test, shadow_dom_image_hashes_test.

uid_pattern: ^uid_fefe · url: puppys\.click

green = sensor SHOULD fire red = sensor should NOT fire
1 · event_tracker · eval_hook · payloadMatcher + payloadExtractor

eval #1 — ClickFix payload fire

>300 chars and keywords: powershell, curl, iex, frombase64string, verify you are human, Win+R.

eval #2 — short benign no fire

<300 chars, no keywords.

eval #3 — long benign no fire

>300 chars but zero malicious keywords → keyword gate blocks.

eval #4 — short malicious no fire

Has keywords but <300 chars → length gate blocks.

2 · shadow_dom_patch · matcher (feature:innerText, >100 chars, no triple \n) + extractor

shadow #1 — >100 chars, clean text fire

innerText >100 chars, no \n\n\n runs. Extractor captures textContent + URLs + id + className.

shadow #2 — nested, long clean text fire

Nested shadow hosts, each >100 chars innerText, no triple-newline.

shadow #3 — long but triple-newline spam no fire

innerText >100 chars but contains \n\n\n → negation gate blocks.

shadow #4 — short text (<100 chars) no fire

innerText is only ~30 chars → length gate blocks.

shadow #5 — CLOSED root no fire

Closed shadow roots are invisible to the patch.

shadow #6 — extension-origin stack no fire

Shadow host created by a Chrome extension (filtered by shadowDomFilter.stackTrace). Simulated via comment in log.

3 · tab sensor · shadow_dom_kb_collection_test · shadowDom: "on" + slot extraction

slot test — slot[name='full-post-link'] fire

<slot name="full-post-link"> inside an open shadow root. The tab sensor with shadowDom: "on" should reach in and extract outerHTML.

slot negative — wrong slot name no fire

<slot name="other-slot"> — selector slot[name='full-post-link'] won't match.

4 · asset_collection · shadow_dom_image_hashes_test · shadowDom: "on" + img hashing

image hash — img[src] inside shadow fire

An <img src="..."> inside an open shadow root (>5KB). The asset_collection sensor with shadowDom: "on" should hash it.

image negative — tiny image no fire

1x1 pixel image inside shadow — below minSize: 5000 filter.

live fixture log