block-invisible-unicode
v0.0.1by open-coder-ai · author: chock-core
block-invisible-unicode is an Agent Plugin published by open-coder-ai that packages 1 skill and no MCP servers for ChatGPT, Codex, Cursor, GitHub Copilot, VS Code, and Kiro. Verified against the official Agent Plugins 1.0.0 schema on 2026-08-18; Apache-2.0 licensed; 1 stars on the host repository.
Pre-commit gate for the mechanizable slice of prompt-injection defense: invisible and direction-override Unicode in staged changes. Bidi controls make code read differently than it parses (Trojan Source, CVE-2021-42574); Unicode tag-block characters smuggle instructions that are invisible to a human reviewer but fully legible to the agent reading the file. Zero-width joiners and bidi marks (ZWJ/ZWNJ/LRM/RLM) are deliberately NOT matched -- they are legitimate in emoji sequences and in Persian, Arabic and Indic text -- so ordinary internationalised content passes; only the override/embed/isolate controls and the tag block, which have no honest use in a source tree, are blocked. Escape: 'pragma: allowlist invisible-unicode' on the same line.
- Skills
- 1
- MCP servers
- 0
- Stars
- 1
- License
- Apache-2.0
Links
Skills · 1
- block-invisible-unicode
Category
Security & Compliance — assigned by this directory, not declared in the manifest.
Keywords
chock · policy-as-code · hook · block · {'control': 'asi01' · 'coverage': 'partial' · 'note': 'blocks the hidden-character slice of goal-hijack payloads a diff can show; semantic injection defense remains advisory (injection-defense · owasp-asi01-agent-goal-hijack)'}
Related plugins
Pre-commit gate for the mechanizable slice of excessive agency: committed agent permission grants that allow everything. A settings file whose shell grant or allow-list is a bare wildcard hands the agent unlimited tool authority for every future session, in a file reviewers rarely read as code. The agent-world twin of block-wildcard-iam: scope grants to what the task needs (e.g. Bash(git status:*)). Escape: 'pragma: allowlist broad-agency' on the same line.
Pre-commit gate for the mechanizable slice of ASI04: agent components pulled at an unpinned version. Blocks npx/uvx/bunx launches at @latest — the standard MCP server idiom — quoted "@latest" arguments in agent config, and :latest container images. Language-manifest dependencies are verify-dependency-exists; signature and provenance stay with the advisory owasp-asi04 policy. Escape: 'pragma: allowlist unpinned' on the same line.
Pre-commit gate for the mechanizable slice of ASI05: bare eval/exec, shell-mode subprocess calls, os.system, pickle/marshal loads, yaml.load without SafeLoader, execSync, new Function. Best-effort line scan; sandbox design, egress, and inherited credentials stay with the advisory owasp-asi05 policy. Escape hatch for vetted uses: 'pragma: allowlist exec' on the same line.
Pre-commit gate for the mechanizable slice of ASI03: wildcard Action or Resource in IAM policy documents, AdministratorAccess attachment, GCP roles/owner or roles/editor, and Terraform wildcard action/resource lists. An agent's identity design stays with the advisory owasp-asi03 policy; this blocks the grants whose blast radius is everything. Escape: 'pragma: allowlist broad-privilege' on the same line.
Block direct commits and pushes to main or master. Enforced at commit time by reading the current branch, and at push time by parsing the refs the agent is pushing.
Pre-commit hook that blocks commits of credential files and high-entropy secret values. Best-effort guard; not a replacement for a dedicated secret scanner.
Show the badge
block-invisible-unicode passed verification against the official 1.0.0 schema. Add the badge to your README to show it — it links readers to this verified listing.
[](https://agentpluginsdirectory.com/plugins/block-invisible-unicode)✓ Verified : manifest fetched from GitHub and checked against the official Agent Plugins 1.0.0 schema (agent-plugins.org).