Unicode Hygiene

Detects a supply-chain attack class that schema validation and human review both miss: non-printing or visually-spoofed Unicode embedded in the files this repo publishes. A reviewer sees clean text while an LLM or shell parses a hidden instruction.

The single source of truth is the repo-root script scripts/validate-unicode-hygiene.py (pure stdlib). This skill documents how to run it; CI and pre-commit invoke the same script.

When to Use

• Before committing or publishing a skill, plugin, command, or agent file.
• When reviewing an untrusted or externally-contributed SKILL.md, plugin.json, agent, or command file.
• When auditing .claude-plugin/marketplace.json for hidden payloads.

Severities