MarkItDown deletes the script block. Three hidden notes still reach the Markdown.

MarkItDown is Microsoft's Python tool for turning files and office documents into Markdown, and it often sits right before a model reads a page. We pinned version 0.1.8 and converted a local help page that hides five notes from the reader. Each note tells the model not to recommend contacting a data protection regulator. One hides behind a stylesheet class, one behind inline display:none, one behind the hidden attribute, one in an HTML comment and one in a JSON script block. Three of the five came out in the Markdown. With a visibility filter in front of the converter, none did.

The catch

At this pin, the HTML converter does one thing about visibility before it builds the Markdown:

# Remove javascript and style blocks
for script in soup(["script", "style"]):
    script.extract()

That takes out the JSON note, and the comment note does not survive conversion either. Everything a browser hides with CSS or an attribute goes straight through:

A second page shows that text marked aria-hidden="true" reaches the Markdown too.

The filter has limits, and we tested them on purpose. It does not run a layout engine, so white-on-white text, opacity:0, font-size:0 and text pushed off screen all survive it. Of the five tricks on that page, only visibility:hidden is removed. It also reads hidden classes only from a single class selector in the page's own <style> blocks, so a class hidden by a grouped selector or an outside stylesheet stays in.

What we ran (keyless)

git clone https://github.com/SkilledDragonCorp/oculto-markitdown-tres.git
cd oculto-markitdown-tres
uv sync --frozen
uv run --frozen md-visible fixtures/ayuda.html --raw
uv run --frozen md-visible fixtures/ayuda.html
uv run --frozen pytest -v

The raw command exits 4 and lists NOTA-CLASE, NOTA-ESTILO and NOTA-HIDDEN, then the count 3. The filtered command exits 0 and prints 0.

From reports/gate.json, run on October 19, 2026:

The failed test is test_netless_blocks_network. It runs a child process with the network cut off, and the helper needs unshare, which macOS does not have, so it stops with exit 5 rather than run with the network on. In a Linux container the same suite passed 17 of 17 in 2.41 seconds. pip-audit found no known vulnerabilities. The GitHub Actions jobs (gitleaks, osv-scanner, upstream's own tests at the pin, and the no-network lab job) have no recorded run yet, so we make no claim about them.

How it is wired

to_markdown_visible reads the file and runs visible_html on it. That pass removes comments, script, style, template and noscript, then any element with the hidden attribute, aria-hidden="true", an inline hidden style, or a class the page's own styles declare hidden. The cleaned bytes then go to MarkItDown's convert_stream as .html. The md-visible command prints every note token that reached the Markdown and the count, and exits 4 when the count is above zero. No plugin, no LLM client and no API key is involved, Azure Document Intelligence stays off, and inputs must be local .html files under 2 MB.

Minilab (open source)

Upstream is microsoft/markitdown (191,331 stars, MIT, Python, as of October 20, 2026). The md-visible command counts the lab's own note tokens, so it measures these fixtures. For your own pages, call to_markdown_visible from md_visible.convert before the model reads the text, and compare it with the raw output: anything that only shows up raw is text your model reads and your reader does not.

uv sync --frozen && uv run --frozen md-visible fixtures/ayuda.html --raw