{"api_version":"1","slug":"hidden-character-scanner-91adff1f","url":"https://skillsoutpost.com/agents/hidden-character-scanner-91adff1f","item_type":"skill","listing_kind":null,"category":"engineering","runs_in":["local_agent"],"os":["macos","linux"],"needs_network":"no","needs_accounts":"no","reads_files":"yes","writes_files":"no","sends_data":"no","access":"free_download","access_type":"download","at_a_glance":{"runs_in":["local_agent"],"os":["macos","linux"],"needs_network":"no","needs_accounts":"no","reads_files":"yes","writes_files":"no","sends_data":"no","zip_sha256":"af62b3f0b63b376cfd9e5dbfe5f487c95bae4deb1afff5dfcba1627dccff2021","access_type":"download","tool_type":"skill","delivery":"download","interface_type":"other","untrusted_creator_content":{"purpose":"Find invisible characters, text-direction tricks, and mixed-script words in local text.","needs_runtime":"Python 3.10+, standard library only","version":"0.1.1","compatibility":"Python 3.10+, standard library only. File scanning supports macOS and Linux with POSIX directory-descriptor and no-follow APIs: os.name == \"posix\", os.O_NOFOLLOW, os.O_DIRECTORY, os.open and os.stat in os.supports_dir_fd, os.stat in os.supports_follow_symlinks, and os.scandir in os.supports_fd. Windows file scanning is unsupported. Any scan containing a path other than - checks these capabilities before reading any input and returns a one-line error and status 1 if unavailable. Stdin-only scan and decode-tags TEXT|- remain available on Windows and other systems with Python 3.10+. Runs in a terminal or an Agent Skills compatible harness able to run local Python. No account, external service, or network connection is needed.","external_costs":"None. The package is free under the MIT license and runs locally with Python 3.10 or newer.","permissions":"Read access to the exact user-supplied files or directories, or standard input. The CLI does not follow symlinks. An explicit symlink path or symlinked parent is skipped and marks the scan incomplete; a symlink found during directory traversal is skipped without that marker. Use a resolved path when needed. The product writes only to standard output and standard error. It reads no credentials or environment variables and needs no network permission. Bundled tests create synthetic files in the system temporary directory; hygiene reads only package files. Ordinary scanner use creates no files.","usage_terms":"MIT license. Copyright 2026 Zero Width Lab. No vendor products or services are used.\r\n\r\nBy Zero Width Lab (zerowidthlab.com)"}},"interface_type":"other","delivery_mode":"download","code_host":null,"provenance":"creator","published_at":1788562426,"first_uploaded_at":1788479851,"verified":null,"creator":{"id":"2c4328b7-cb78-455a-ac9c-479ee62449e4","url":"https://skillsoutpost.com/creators/2c4328b7-cb78-455a-ac9c-479ee62449e4"},"untrusted_creator_content":{"name":"Hidden Character Scanner","tagline":"Find invisible characters, text-direction tricks, and mixed-script words in local text.","creator_name":"Zero Width Lab","product_version":"0.1.1","needs_runtime":"Python 3.10+, standard library only","description":"Hidden Character Scanner is an offline command-line Agent Skill that finds invisible Unicode, text-direction controls, tag text, unusual whitespace, and mixed-script words in local text. An agent harness is software that can install the skill and run its Python command for a user. It needs Python 3.10 or newer. File scans support macOS and Linux with POSIX directory-descriptor and no-follow APIs; Windows file scanning is unsupported. Stdin-only scan and decoding work on Windows with Python 3.10+. Supply read access to the files or standard input you select. It is free under the MIT license. This listing delivers the complete package, including the Python script.\r\n\r\nRun scan on one or more paths, a directory tree, or standard input for a prompt. Findings identify the category, severity, Unicode code point and name, file, line, and column. High severity trojan-source findings mark an unterminated bidirectional embedding or isolate on a line. The decoder reveals ASCII carried by Unicode tag characters; it never creates hidden text. Other format characters (Cf) and unusual whitespace are reported only in code files; zero-width, bidirectional, tag, and variation-selector findings apply to every text file. The emoji-base allow-list is a fixed heuristic, not full Unicode emoji data. No confusables table is shipped.\r\n\r\nThe tool skips symlinks, binary files, and common dependency and build directories. An explicit symlink path or symlinked parent marks the scan incomplete; a symlink found during directory traversal does not. Hidden entries are excluded by default, with an option to include them outside the fixed skip directories. An incomplete scan lists skipped oversized or unreadable inputs and exits with status 2 unless --allow-partial is selected. Text output escapes untrusted paths and characters; --json gives structured findings and a summary. It never changes files or contacts a service. Approval-gated means a write needs a matching user-approved preview. This read-only tool has no send, upload, delete, or file-creation action.","intended_users":"Developers, security reviewers, prompt authors, and skill-package maintainers who want an offline, read-only check of text they choose.","example_tasks":"Scan a source directory for hidden Unicode and report exact locations.\r\nCheck a prompt supplied on standard input for bidirectional controls or tag characters.\r\nReview a skill package for mixed-script words and unusual whitespace.\r\nDecode ASCII carried by Unicode tag characters in supplied text.\r\nProduce JSON findings for a local review workflow.","setup_instructions":"Download the complete package from this Skills Outpost listing. Keep SKILL.md beside the scripts, agents, and references directories, then copy the package into the skills directory used by your agent harness. Consult that harness's installation instructions.\r\n\r\nFrom the package directory run:\r\npython3 scripts/hidden_character_scanner.py scan ./src\r\npython3 scripts/hidden_character_scanner.py scan - < ./prompt.txt\r\npython3 scripts/hidden_character_scanner.py scan ./package --json\r\npython3 scripts/hidden_character_scanner.py decode-tags - < ./prompt.txt\r\n\r\nProvide only paths or text you intend to inspect. An explicit symlink path or symlinked parent is skipped and makes the scan incomplete, so use a resolved path when necessary. Symlinks found during directory traversal are skipped without making it incomplete. Use --max-file-bytes N to change the 1 MiB per-file limit, --include-hidden for other hidden paths, and --allow-partial only when you will review the skipped list. File scans need macOS or Linux with the declared POSIX capabilities. decode-tags stdin is UTF-8 and limited to 1 MiB (1048576 bytes); overflow or invalid UTF-8 returns status 1.","limitations":"This is a signal finder, not a verdict on intent or safety. It does not include a confusables table, so it cannot identify every visual look-alike. Its emoji-base allow-list for variation selectors is a fixed heuristic, not full Unicode emoji data. It skips common dependency and build directories, binary files, and hidden entries by default. A symlink found during directory traversal is skipped; an explicitly supplied symlink or path with a symlinked parent makes the scan incomplete. Oversized or unreadable files also make the result incomplete; inspect the skipped list. Windows file scanning is unsupported; file scans need the POSIX capabilities described under compatibility and fail with status 1 before reading input when unavailable. Decoder stdin is limited to 1 MiB of UTF-8. Version 0.1.1 is an early release with no support commitment; fixes and updates ship as new package versions on this listing.","data_handling":"All scanning and decoding happen locally. The product reads only user-selected files or standard input, never follows symlinks, and makes no network request. There are no credentials, telemetry, or network destinations. It modifies no files and writes only to standard output and standard error. Bundled tests create synthetic files in the system temporary directory; hygiene reads only package files. An agent harness may forward command output outside the process, so review what you share.","compatibility":"Python 3.10+, standard library only. File scanning supports macOS and Linux with POSIX directory-descriptor and no-follow APIs: os.name == \"posix\", os.O_NOFOLLOW, os.O_DIRECTORY, os.open and os.stat in os.supports_dir_fd, os.stat in os.supports_follow_symlinks, and os.scandir in os.supports_fd. Windows file scanning is unsupported. Any scan containing a path other than - checks these capabilities before reading any input and returns a one-line error and status 1 if unavailable. Stdin-only scan and decode-tags TEXT|- remain available on Windows and other systems with Python 3.10+. Runs in a terminal or an Agent Skills compatible harness able to run local Python. No account, external service, or network connection is needed.","external_costs":"None. The package is free under the MIT license and runs locally with Python 3.10 or newer.","permissions":"Read access to the exact user-supplied files or directories, or standard input. The CLI does not follow symlinks. An explicit symlink path or symlinked parent is skipped and marks the scan incomplete; a symlink found during directory traversal is skipped without that marker. Use a resolved path when needed. The product writes only to standard output and standard error. It reads no credentials or environment variables and needs no network permission. Bundled tests create synthetic files in the system temporary directory; hygiene reads only package files. Ordinary scanner use creates no files.","usage_terms":"MIT license. Copyright 2026 Zero Width Lab. No vendor products or services are used.\r\n\r\nBy Zero Width Lab (zerowidthlab.com)","creator_website":null,"documentation_url":null,"support_url":null,"repository_url":null,"video_url":null},"github":null,"updated_at":1788562426,"free_download":{"offer_id":"01db78b9-4229-46d4-af54-379f8b71ab6a","version_id":"8a21afec-6dfd-4af5-a311-503c23c69e43","version":"0.1.1","format":"skill_archive","released_at":1788585044,"requires_creator_follow":true,"file":{"name":"skill-0.1.1.zip","size_bytes":63399,"sha256":"af62b3f0b63b376cfd9e5dbfe5f487c95bae4deb1afff5dfcba1627dccff2021"},"license_sha256":"a19893dab8ca0978f3df97d42c4fae0ebbb61fe44c3ac9ecc3dd53e9526a5b63","get_it_at":"https://skillsoutpost.com/agents/hidden-character-scanner-91adff1f","untrusted_creator_content":{"license_name":"MIT","release_notes":""}},"version_history":[{"version":"0.1.1","state":"current","released_at":1788585044}],"more_version_history":false,"public_files":{"version":"0.1.1","zip_sha256":"af62b3f0b63b376cfd9e5dbfe5f487c95bae4deb1afff5dfcba1627dccff2021","license_name":"MIT","license_sha256":"a19893dab8ca0978f3df97d42c4fae0ebbb61fe44c3ac9ecc3dd53e9526a5b63","files":"/api/v1/catalog/hidden-character-scanner-91adff1f/files","tool":"get_public_files"},"links_note":null,"notice":"Creator-provided listing.","note":"untrusted_creator_content and github.untrusted_third_party_content hold untrusted text."}