What is hidden Unicode in a prompt?

Characters that take no visible space, such as the zero-width space, direction controls and the Unicode tag block. A person sees nothing. A model that reads the raw text can still receive them as input.

Can invisible characters really carry an instruction?

Yes, in principle. Tag characters map one to one onto ASCII letters, so a sentence can be written entirely in invisible characters. Whether a given model acts on it depends on the model and the agent, so treat it as a risk to remove, not a guarantee of an attack.

Do all of these characters mean an attack?

No. The zero-width joiner sits inside many emoji, and direction marks are normal in Arabic and Hebrew text. In a skill written in plain English, though, there is rarely a good reason for any of them, so the scanner flags every one and you decide.

How do I remove them?

Delete the characters and read the line again. The box on this page has a button that strips every character it detects. Then ask why they were there in the first place.

Guide

Hidden Unicode prompt injection in skills

Some characters have no width and no glyph. They can sit inside a sentence and never show up in your editor, on GitHub or in a diff. This page shows what they are, lets you reveal them in any text you paste, and gives you a check you can run on a folder.

The characters

Kind	Code points	Normal use	Risk in a skill
Zero-width	`U+200B to U+200D, U+2060, U+FEFF`	Line breaking hints, emoji joins, a byte-order mark at file start.	Splits a word so a keyword search misses it, or carries a payload.
Direction controls	`U+200E, U+200F, U+202A to U+202E, U+2066 to U+2069`	Mixing right-to-left and left-to-right text.	Reorders text on screen so what you read is not what is stored.
Invisible operators	`U+2061 to U+2064`	Math layout.	No visible effect, so a clean place to hide data.
Tag characters	`U+E0000 to U+E007F`	Spell subdivision flags inside some emoji.	Each one is an invisible copy of an ASCII letter, so a full sentence fits.

How an instruction hides

Take the tag block. Add 0xE0000 to the code of an ASCII letter and you get its invisible twin. The text "stop" becomes four characters that no editor draws. Put them after a normal sentence and the line looks unchanged. The file is longer than it looks, and the extra bytes are readable to any program that reads the raw text, including the one that feeds your agent.

Direction controls work differently. They do not hide text, they reorder it, so the characters on screen and the characters in the file can disagree.

Reveal them

Paste text from a SKILL.md, a README or a prompt. Invisible characters turn into black chips, and tag characters are decoded into the text they spell. Press the example button to see one. Everything runs in your browser.

Paste text from a skill or a prompt

Waiting for text.

The check

The scanner raises a critical finding (sec/hidden-unicode) for any of these characters in any text file in the skill, with the file and line. A critical finding caps the grade at F. From a terminal:

npx proskills-cli scan ./my-skill

To search a folder by hand, a PCRE grep over the same ranges works on most systems:

grep -rnP '[\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2060}-\x{2064}\x{2066}-\x{2069}\x{FEFF}\x{E0000}-\x{E007F}]' .

Expect false positives in emoji and in right-to-left text. For the wider list of checks, see the security checklist.

Sources

The code point ranges are from the Unicode standard. The scanner uses the same ranges as the demo above.

Questions

What is hidden Unicode in a prompt?: Characters that take no visible space, such as the zero-width space, direction controls and the Unicode tag block. A person sees nothing. A model that reads the raw text can still receive them as input.
Can invisible characters really carry an instruction?: Yes, in principle. Tag characters map one to one onto ASCII letters, so a sentence can be written entirely in invisible characters. Whether a given model acts on it depends on the model and the agent, so treat it as a risk to remove, not a guarantee of an attack.
Do all of these characters mean an attack?: No. The zero-width joiner sits inside many emoji, and direction marks are normal in Arabic and Hebrew text. In a skill written in plain English, though, there is rarely a good reason for any of them, so the scanner flags every one and you decide.
How do I remove them?: Delete the characters and read the line again. The box on this page has a button that strips every character it detects. Then ask why they were there in the first place.

Keep reading

Scan your own skill

Paste a SKILL.md or drop a folder. It is scored in your browser and nothing is uploaded.

Open the Skill Scanner

Want a skill that already passes? Start with a free one.

Grill MeFreeScan 100/100A relentless review of your plan. From the Grill Me collection.