Spellwarden

All docs

Hidden Unicode characters in agent skills

Last updated 7 November 2026

Some Unicode characters take no space on screen. A person reads the visible text and a model reads all of it, including the characters that cannot be seen. That gap lets an attacker put instructions into a skill, a tool description or an agent card that no reviewer sees. Below are the technique in plain words, the Spellwarden scanner rules that detect it, and what they do not detect.

What it is

Three groups of characters matter. Zero-width characters, such as the zero-width space, show nothing. Bidirectional controls change the order in which text is displayed, so that a line can read differently from the way a program or a model reads it. Tag characters, in the block that starts at code point U+E0000, mirror the ASCII letters but are not drawn by most interfaces.

The last group is the one that can carry a whole sentence. The example shows text, not an attack: a visible line, and the code points of a hidden line that would follow it. Each tag character is the letter at the same position, so the hidden line here reads Ignore.

Visible text:   Please summarise this file.
Hidden after it (tag characters, written as code points):
U+E0049 U+E0067 U+E006E U+E006F U+E0072 U+E0065

Johann Rehberger described this in January 2024 and published a tool, which he calls ASCII Smuggler, that encodes text into tag characters and decodes it again. ASCII smuggling is the name of the technique as that tool uses it.

How it works

  1. An attacker adds hidden characters to a file, a description or a card, often after a normal sentence.
  2. A reviewer opens the text, sees nothing unusual and approves it.
  3. The model receives the characters with the rest of the text and can read the hidden sentence.
  4. The model acts on it, in the same way as on any other prompt injection.

Hiding is often combined with a visible phrase that a pattern would catch. For that reason a scanner that looks for phrases removes invisible characters first, so that a phrase split by one is still found.

Sources

Read on 7 November 2026.

Rules that detect it

Detects

Rules that detect this attack
RuleTitleHow it relates
SW-SKL-002Hidden text: zero-width or bidirectional control charactersZero-width, bidirectional and tag-block characters in the text files of a skill.
SW-A2A-014Agent card text contains injected instructions or hidden charactersReports hidden characters in agent card text, and removes them before it matches phrases.

Partly covers

Rules that partly cover this attack
RuleTitleHow it relates
SW-SKL-001Prompt-injection phrases in skill instructionsRemoves invisible characters first, so a phrase split by one is still found.
SW-MCP-011Tool description contains instruction-like textDoes the same before it matches a tool description.

SW-SKL-002 is the rule for a skill's files. SW-A2A-014 reports hidden characters in the text of an A2A agent card. The two rules in the second table remove the characters before they look for phrases, so they find a phrase that was split, and they do not report the characters.

What no rule covers

SW-MCP-011 finds the phrase but does not report the hidden characters. The scanner reads the text files of a skill package, not binary files.

What to do

  1. Scan text that a model will read with the open-source scanner, which reports hidden characters in a skill's files and in agent cards.
  2. Do not rely on how a file looks in an editor. Open it in a view that shows invisible characters, or compare it with a clean copy.
  3. Treat a hidden character in a skill, a description or a card as a finding to explain, because honest text has no reason to carry one.
  4. Follow How to vet an MCP server or an agent skill before you install anything, and read Scanner rules for the full list.