SD-002 — Prompt Injection

Instructions addressed to the agent rather than the reader: role overrides, 'ignore previous', hidden or zero-width text, invisible Unicode.

The agent reads the whole file as instructions, so a line the reviewer never sees is a line the agent obeys. Zero-width and bidi-control characters render as nothing, and an HTML comment renders as nothing in a Markdown preview — the skill a human approves and the skill an agent executes are then different documents. Once the agent accepts the override it can be steered into any of the other patterns on this page, reading credentials or calling out to a host of the author's choosing, with no further payload in the file.

Delete the hidden text. Instructions to the agent belong in the visible body of the file, where a reviewer reads the same bytes the model does. Strip zero-width and bidi control characters, and drop chat-template markers such as [INST] or <<SYS>> — a skill has no reason to spell its own system prompt.

Security documentation that demonstrates an injection payload, and legitimate emoji sequences near the zero-width joiner heuristic.

Pattern SD-002 was detected in 100 of 16475 public skills scanned as of 11 September 2026.