Hidden Unicode Tag Prompt Injection in Agent Skills (Supply Chain Backdoor)

Technical Analysis

The attack embeds hidden instructions using Unicode Tag block codepoints (invisible to humans in normal editors/diff viewers) inside a legitimate-looking Skill file, such as one distributed by OpenAI. When the agent loads and processes the Skill, certain LLMs decode and act on the hidden Unicode text as if it were part of the trusted system/tool content, effectively achieving prompt injection without any visibly suspicious text. This crosses the supply-chain boundary because Skills are treated as trusted, reviewed artifacts, yet the invisible payload bypasses human code review while still being machine-interpretable, giving the attacker a stealth foothold to hijack agent behavior, exfiltrate data, or trigger further tool calls. The researcher also released a scanner and proposed detection patches to OpenClaw to catch such hidden codepoint injections.

Affected Systems

OpenAI Skills, OpenClaw

Detection Signatures

• Presence of Unicode Tag block codepoints (U+E0000–U+E007F) in Skill files, prompts, or tool descriptions
• Non-printable/invisible characters detected in diff or file content that render as empty strings
• Skill or tool metadata files with byte length inconsistent with visible character count
• Use of automated Unicode-normalization or invisible-character scanners flagging anomalies in downloaded Skills
• Unexpected agent behavior changes after loading a new or updated Skill package

Remediation Steps

1. 1

   Scan Skills for hidden Unicode codepoints

   Run automated scanners (e.g., the referenced AID tool) against all Skill files to detect Unicode Tag characters and other invisible/steganographic text before deployment.

2. 2

   Normalize and strip non-printable Unicode

   Sanitize all ingested Skill/tool content by stripping non-printable and tag-block Unicode characters prior to feeding them into model context.

3. 3

   Enforce supply-chain integrity checks

   Require signed, hash-verified Skill packages from trusted sources and diff visible vs. raw byte content to catch discrepancies introduced by hidden characters.

4. 4

   Restrict model interpretation of invisible characters

   Where possible, configure or fine-tune models/agents to ignore or flag non-standard Unicode ranges rather than silently execute them as instructions.

5. 5

   Human + automated dual review pipeline

   Combine human code review with automated byte-level content scanning specifically because Unicode Tag injections are designed to evade visual inspection.