Invisible Unicode (Category 30)
Four new checks for characters that render as nothing but are read and acted on by an agent.
- 30.1 ascii-smuggling (Critical) — Unicode tag characters carrying a hidden ASCII message. Well-formed flag emoji (U+1F3F4 + tag letters + cancel tag) are exempt.
- 30.2 bidi-override (Critical) — trojan-source bidirectional controls (CVE-2021-42574), where displayed text differs from actual text. Bilingual right-to-left prose is exempt.
- 30.3 invisible-run — 10 or more consecutive invisible characters on a line is Critical as a hidden-data channel; 40 or more is unambiguous.
- 30.4 invisible-char — 3 or more grouped zero-width characters is a Warning, an isolated one a Suggestion.
The checks run as read-only Grep patterns, because these characters cannot be spotted by reading the file.
Codepoint categories and run thresholds adapted from NVIDIA SkillEvaluator (Apache-2.0); the emoji carve-out follows NVIDIA SkillSpector.
Try it in your browser: https://validate.getskillcheck.com