Key Features
unicode-shieldcleans incoming text by removing hidden Unicode tricks like zero-width characters, control characters, tag characters, and variation selectors so prompts are safer by default. This helps stop invisible prompt injection and weird parser behavior before it reaches your app logic.- It neutralizes bidirectional (bidi) controls that can visually flip or disguise text, with modes to strip, escape, or ignore based on your risk level. That makes suspicious strings easier to trust and debug.
- It normalizes deceptive text forms, including fullwidth/math/circled characters (NFKC) and common cross-script lookalikes (like Cyrillic/Greek homoglyphs). This improves matching and filtering so words that look the same are treated the same.
- It limits stacked combining marks (Zalgo-style noise) and can normalize exotic whitespace to regular spaces. The result is cleaner, more stable text for moderation, search, and LLM pipelines.
- You get a simple API:
normalize()for clean output,analyze()for detailed findings, andcreateShield()for reusable config. It ships as TypeScript with zero runtime dependencies, so it’s easy to drop into Node, Bun, and browser workflows.
Highlights
- This initial release focuses on practical Unicode hardening: clean first, then process safely. It’s especially useful for AI agents, chat apps, and any system that consumes untrusted user text. 🛡️
- Test coverage is broad across real attack patterns (including an iMessage-focused matrix), so behavior is grounded in concrete threat cases rather than theory. No breaking changes to report in this initial release.
Version: 0.0.1