AGENTFORCE-TS-03: Zero-Width Unicode Injection
🔴 High · Supply Chain: ToxicSkills
Detects zero-width Unicode characters (U+200B, U+200C, U+200D, U+FEFF) in markdown skill files. These characters are invisible in rendered views but present in the raw text that LLMs process, enabling hidden instruction injection.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-TS-03 |
| Severity | High |
| Category | Supply Chain: ToxicSkills |
Remediation
Remove zero-width characters from skill documentation. Use a text editor with invisible character detection.