The Agent Skills Directory

[OBFUSCATION]: The title header in SKILL.md contains a significant volume of hidden content using Unicode zero-width characters (ZWSP, ZWNJ, ZWJ, and Word Joiner). Evidence: The title '# Dave Cheney Style Guide' is interspersed with a sequence of U+2060, U+200D, U+200B, and U+200C characters. These characters are organized into 8-bit chunks, a method commonly used to encode binary data or text that is invisible to the human eye but interpretable by AI models.
[PROMPT_INJECTION]: The hidden Unicode content is a documented vector for steganographic prompt injection attacks. Security scanners flagged this specific pattern as a malicious attempt to hide instructions intended to override agent behavior, bypass safety filters, or exfiltrate information without user oversight.
[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface where hidden instructions can influence the agent's code generation tasks. Ingestion points: The agent loads instructions from the SKILL.md file. Capability inventory: The agent is authorized to generate production Go code, which can include file system operations. Boundary markers: The hidden content lacks any boundary markers or instructions to ignore embedded commands. Sanitization: There is no evidence of filtering or sanitization applied to the hidden content within the skill's instructions.

cheney-practical-go