unicode-hygiene

Detect non-printing or visually-spoofed Unicode in files with stdlib Python scripts.

1|Updated Jan 4, 2026
One-click install
npx skills add https://github.com/bossjones/boss-skills --skill unicode-hygiene
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: unicode-hygiene
Source: https://github.com/bossjones/boss-skills/tree/main/plugins/boss-dev/agent-harness/skills/unicode-hygiene
Command: npx skills add https://github.com/bossjones/boss-skills --skill unicode-hygiene

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill identifies invisible or visually-spoofed Unicode in files, preventing supply-chain attacks and ensuring file integrity before commits or publications.

Core Features & Use Cases

  • Unicode Detection: Identifies tag characters, bidirectional overrides, zero-width characters, and mixed-script identifiers.
  • Pre-commit Scan: Ensures files are safe before committing or publishing.
  • Use Case: Before pushing a skill or plugin, use this Skill to scan for hidden instructions that could compromise security.

Quick Start

Run the unicode-hygiene skill to scan the current directory for hidden Unicode threats.

Frequently Asked Questions about unicode-hygiene

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan files for hidden Unicode characters before committing?

Scan files for hidden Unicode characters by running a Python script that detects tag characters, bidirectional overrides, and zero-width characters to ensure file integrity before commits. This prevents supply-chain attacks by identifying visually-spoofed code.

What are bidirectional overrides and zero-width characters in source code?

Bidirectional overrides and zero-width characters are non-printing Unicode threats used to visually spoof source code. They hide malicious instructions or alter text display, creating supply-chain vulnerabilities that compromise file integrity during security reviews.

Can I detect mixed-script identifiers in Python without external dependencies?

Yes, you can detect mixed-script identifiers using stdlib Python scripts without external dependencies. This approach scans files to identify visually-spoofed Unicode and prevents supply-chain attacks before pushing a skill or plugin.

Does pre-commit scanning for supply-chain attacks require external security tools?

Pre-commit scanning for supply-chain attacks does not require external security tools. It applies stdlib Python scripts to detect non-printing Unicode threats, ensuring file auditing and security reviews function without adding dependencies to your environment.

Why should I audit files for visually-spoofed Unicode before publishing?

Audit files for visually-spoofed Unicode before publishing to prevent supply-chain attacks. Hidden tag characters and bidirectional overrides can inject invisible instructions, compromising file integrity and security when others use your published code.

What is the best way to prevent invisible Unicode threats in a repository?

The best way to prevent invisible Unicode threats is to run a pre-commit scan that identifies tag characters, bidirectional overrides, and zero-width characters. This file auditing process ensures repository integrity before pushing code.