Pegboard
Docs menu

Audit skills

How Pegboard blocks skills that hide instructions in invisible Unicode, and how to scan everything your agents read.

A skill is text your agent follows. Some Unicode characters don’t show up in an editor or a diff, but the model still reads them. They can reorder what you see on screen, or carry a whole hidden instruction. Pegboard looks for them before a skill reaches your agents.

In the plan

Before placing a skill, plan and apply scan its files:

claude-code · global
  ! skill sneaky  hidden Unicode that can hijack an agent: SKILL.md:4:12 U+202E RIGHT-TO-LEFT OVERRIDE (review it; --allow-hidden-unicode installs it)
  + skill zw      (~/.claude/skills/zw → ~/.config/pegboard/skills/zw)
      ⚠ invisible characters: SKILL.md:4:6 U+200B ZERO WIDTH SPACE
Severity Characters What happens
Critical Bidirectional overrides and isolates (U+202A–202E, U+2066–2069), Unicode tags (U+E0000–E007F), the variation selector supplement (U+E0100–E01EF) The skill is a conflict and isn’t installed
Warning Zero-width spaces, joiners and marks, word joiners and invisible operators, a byte order mark after the start of a file, soft hyphens The plan shows a warning

A zero-width joiner between two emoji, as in 👩‍💻, is how those emoji are built, so it isn’t reported.

--force doesn’t let a critical skill through. If you’ve read it and still want it, use --allow-hidden-unicode.

Scan what your agents already have

pegboard audit

audit scans every skill in your agents’ skills directories, whether or not Pegboard put it there, plus the skills your stack declares and your context files (AGENTS.md, CLAUDE.md, and the rest).

skill sneaky · global (~/.claude/skills/sneaky) — claude-code
  critical SKILL.md:4:12 U+202E RIGHT-TO-LEFT OVERRIDE
Scanned 6 items: 1 critical, 0 warnings.
Flag What it does
--exit-code Exit with 2 if there are critical findings
--strict With --exit-code, warnings count too
--json Stable output, with each finding’s file, line, column, and code point

To run it on every pull request, use the GitHub Action with command: audit.

Other checks

  • Git skills and stacks are pinned by commit and content hash.
  • MCPs from shared stacks need your approval.
  • pegboard lock export prints an SBOM of everything the lock pins.