unicode-hygiene
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute a local Python script located at
scripts/validate-unicode-hygiene.pyusinguv run. This command execution is the primary, intended purpose of the skill to facilitate security scanning of the repository content.\n- [PROMPT_INJECTION]: The skill analyzes untrusted third-party files (skills, plugins, and marketplace manifests) for malicious Unicode content. This represents a surface for indirect prompt injection where specially crafted files could target the analysis tool.\n - Ingestion points: Local files (e.g., SKILL.md, plugin.json) passed as arguments to the validation script.\n
- Boundary markers: The validation script itself acts as the boundary, though no explicit delimiters are mentioned in the instruction markdown.\n
- Capability inventory: The skill has the capability to execute a local Python script via Bash.\n
- Sanitization: The script's core logic is designed to perform sanitization and validation by detecting and reporting unsafe Unicode sequences.
Audit Metadata