← skillsmith scanner · all guides

Homoglyph Attacks on Agent Skills

Guide · skillsmith.ch

A homoglyph is a character that looks identical (or nearly identical) to another but has a different code point. а vs a: the first is Cyrillic small letter a (U+0430), the second Latin (U+0061). To your eyes they are the same. To a string comparison, a domain filter, or an allowlist, they are completely different characters.

Why this matters for SKILL.md files

Agent skills are trusted partly through names and URLs. Homoglyphs attack exactly those anchors:

• Skill typosquatting: publish pdf-toolkit with a Cyrillic а. It renders the same, sorts the same, and passes casual review.
• Allowlist evasion: a skill claims to only talk to github.com — but the exfiltration host is githuЬ.com (Cyrillic Ь) and your reviewer's pattern match sees only "github".
• Comment smuggling: injection instructions hidden inside what looks like harmless documentation text.

Where they hide

• Cyrillic/Greek letters that mirror Latin: а е о р с у х А В Е К М Н О Р С Т Х
• Look-alike punctuation: fullwidth dots, mathematical dots, IPA glyphs
• Zero-width joiners and zero-width spaces between visible characters
• Combining marks attached to ordinary letters

How to defend

1. Normalize before comparing: NFKC normalization folds many look-alikes back to ASCII. Compare normalized forms everywhere.
2. Restrict scripts: a legitimate English-language SKILL.md almost never needs Cyrillic or Greek letters. Flag any non-ASCII code point outside expected ranges.
3. Inspect byte level: search the file for code points U+0400–U+04FF, U+0370–U+03FF, U+200B–U+200F and U+FEFF. Any hit deserves a second look at its context.
4. Verify domains character by character when reviewing exfiltration targets — paste into a punycode/IDN decoder.

What skillsmith does about it

The detection engine runs a linear scan for suspicious Unicode: non-ASCII code points in homoglyph-prone ranges raise findings with their context, so a Cyrillic а buried in an otherwise clean file surfaces immediately instead of hiding behind visual inspection. Combined with structural detection, paraphrased injections stop relying on your eyes.

Try it yourself

Paste any SKILL.md into the scanner and check the findings for unicode warnings. If you want the full picture of what a hostile skill can do, start with threat modeling.