Discover the toolingbehind modern intelligence
The operating system for AI infrastructure discovery. Search a live map of MCP servers, AI agents, LLM tools, automation systems, and developer infrastructure.
unicode-skill-injection-poc
Proof-of-concept demonstrating invisible Unicode prompt injection in AI agent skill files. This project shows how the Unicode Tags block (U+E0000–U+E007F), zero-width characters, and bidirectional overrides can embed hidden instructions in AI agent skill files (SKILL.md) that are invisible to human reviewers but fully
1stars
0forks
Python
agentinjectionllmprompt-injectionsecurityunicode
Quality signals
ActiveNo testsNo CIThin docsNo licenseNew
InstallSKILLInstall as a Claude Code skill
Universal installANY TOOL
$ npx skillcity@latest hugobatista/unicode-skill-injection-pocAuto-detects the skill or MCP server in this repo and installs it for Claude Code, Codex, Cursor, Cline, OpenCode, Gemini CLI, Anti-Gravity, OpenClaw and Hermes.
Requires Node.js 18+ (ships with npx).
Or install manually
# Install into ~/.claude/skills/ mkdir -p ~/.claude/skills/unicode-skill-injection-poc curl -fsSL https://raw.githubusercontent.com/hugobatista/unicode-skill-injection-poc/main/SKILL.md -o ~/.claude/skills/unicode-skill-injection-poc/SKILL.md
Loading README…
Ask a simulated agent to run this skill. It loads the real SKILL.md and reasons over your task with NVIDIA.
unicode-skill-injection-poc — sandboxAI sandbox
Pick a quick prompt below or type your own — watch the agent execute this skill step by step.
guest@skillcity:~$Try a prompt