[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CAMNX6WNY3KEXZ2F8CCVME":3,"skill-same:01M6CAMNX6WNY3KEXZ2F8CCVME":105},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":55,"linkOnly":56,"markdownContent":57,"markdownBody":58,"frontMatter":59,"refName":81,"commitSha":82,"skillDirectory":83,"forksCount":84,"repositoryHtmlUrl":85,"repositoryHomepageUrl":86,"ownerHtmlUrl":87,"ownerBlogUrl":88,"ownerDescription":89,"updatedAt":90,"install":91,"resources":104},"01M6CAMNX6WNY3KEXZ2F8CCVME","confusable-unicode-audit",null,"Detect bidi controls, zero-width characters, mixed-script identifiers, and homoglyph risks in source and release metadata","jmagly\u002Faiwg","jmagly","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1159087?v=4","01M6C10AK8N2WCSQN11FYGTJWN","Joseph Magly","01M6C10AQ8A2RMED1Y1BSVY7NF",229,"MIT","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fconfusable-unicode-audit\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54],"Unicode","audit","confusable unicode audit","format","inspection","when","source","false","efficiency","context","read","grep","haiku","text","suspicious","json","Bash","SET","ZeRO","repository","yaml","file","release","code","status","security","2026-11-10 10:12:30",false,"---\nnamespace: aiwg\nname: confusable-unicode-audit\nplatforms: [all]\ndescription: Detect bidi controls, zero-width characters, mixed-script identifiers, and homoglyph risks in source and release metadata\nrequires:\n  - git: repository file enumeration\nensures:\n  - report: suspicious Unicode occurrences with code point, context, and allowlist status\n  - exit-code: non-zero when violations found and --fail-on-violation is set\nerrors:\n  - allowlist-invalid: .aiwg\u002Fsecurity\u002Fconfusable-unicode-allowlist.yaml cannot be parsed\ninvariants:\n  - exact code points are reported so reviewers do not need visual inspection\n  - allowlisted non-ASCII is still included in the exceptions section\ncommandHint:\n  argumentHint: \"[--fail-on-violation] [--include-metadata] [--format text|json]\"\n  allowedTools: Read, Bash, Grep\n  model: haiku\n  category: security\n  orchestration: false\n  modelRole: efficiency\n  modelTier: economy\n---\n\n# Confusable Unicode Audit\n\nDetect Trojan Source and homoglyph risks in source files, dependency names, and release metadata. This enforces `no-confusable-unicode` and maps curl Practice 8 into an AIWG control.\n\n## Detection Targets\n\n- Bidirectional controls: U+202A through U+202E, U+2066 through U+2069.\n- Zero-width characters: U+200B through U+200F, U+FEFF.\n- Non-ASCII identifiers in source code.\n- Mixed-script identifiers, especially Latin plus Cyrillic or Greek.\n- Package\u002Fdependency names containing non-ASCII or confusable characters.\n- Optional metadata scan: commit subject, PR titles, release notes.\n\n## Allowlist\n\nLegitimate non-ASCII is declared in `.aiwg\u002Fsecurity\u002Fconfusable-unicode-allowlist.yaml`:\n\n```yaml\nversion: 1\nallow:\n  - path: \"docs\u002Fi18n\u002F**\"\n    reason: \"localized documentation\"\n  - identifier: \"naive_bayes\"\n    codepoints: [\"U+00EF\"]\n    reason: \"historical exported API spelling\"\n```\n\n## Output\n\nReports show file, line, column, Unicode code point, character name, and remediation. Bidi and zero-width controls are always HIGH severity.\n\n## References\n\n- `agentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Frules\u002Fno-confusable-unicode.md`\n- Unicode TR39\n- Trojan Source \u002F CVE-2021-42574\n","# Confusable Unicode Audit\n\nDetect Trojan Source and homoglyph risks in source files, dependency names, and release metadata. This enforces `no-confusable-unicode` and maps curl Practice 8 into an AIWG control.\n\n## Detection Targets\n\n- Bidirectional controls: U+202A through U+202E, U+2066 through U+2069.\n- Zero-width characters: U+200B through U+200F, U+FEFF.\n- Non-ASCII identifiers in source code.\n- Mixed-script identifiers, especially Latin plus Cyrillic or Greek.\n- Package\u002Fdependency names containing non-ASCII or confusable characters.\n- Optional metadata scan: commit subject, PR titles, release notes.\n\n## Allowlist\n\nLegitimate non-ASCII is declared in `.aiwg\u002Fsecurity\u002Fconfusable-unicode-allowlist.yaml`:\n\n```yaml\nversion: 1\nallow:\n  - path: \"docs\u002Fi18n\u002F**\"\n    reason: \"localized documentation\"\n  - identifier: \"naive_bayes\"\n    codepoints: [\"U+00EF\"]\n    reason: \"historical exported API spelling\"\n```\n\n## Output\n\nReports show file, line, column, Unicode code point, character name, and remediation. Bidi and zero-width controls are always HIGH severity.\n\n## References\n\n- `agentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Frules\u002Fno-confusable-unicode.md`\n- Unicode TR39\n- Trojan Source \u002F CVE-2021-42574\n",{"name":5,"errors":60,"ensures":63,"requires":68,"namespace":71,"platforms":72,"invariants":74,"commandHint":77,"description":7},[61],{"allowlist-invalid":62},".aiwg\u002Fsecurity\u002Fconfusable-unicode-allowlist.yaml cannot be parsed",[64,66],{"report":65},"suspicious Unicode occurrences with code point, context, and allowlist status",{"exit-code":67},"non-zero when violations found and --fail-on-violation is set",[69],{"git":70},"repository file enumeration","aiwg",[73],"all",[75,76],"exact code points are reported so reviewers do not need visual inspection","allowlisted non-ASCII is still included in the exceptions section",{"model":41,"category":54,"modelRole":37,"modelTier":78,"allowedTools":79,"argumentHint":80,"orchestration":56},"economy","Read, Bash, Grep","[--fail-on-violation] [--include-metadata] [--format text|json]","main","6754967c344ccb087a8de06972f55a41067b291b","agentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fconfusable-unicode-audit",36,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg","https:\u002F\u002Faiwg.io","https:\u002F\u002Fgithub.com\u002Fjmagly","https:\u002F\u002Fintegrolabs.io","ml\u002Fai, industrial automation, safety\u002Fsecurity, ssi\r\n\r\nmagly.net\r\nintegrolabs.io\r\naiwg.io\r\nfortemi.com\r\npagenary.com\r\nbytecask.com","2026-11-14 02:10:01",{"source":8,"skillName":5,"commands":92,"prompt":102,"zipAvailable":103},[93,96,99],{"tool":94,"command":95},"npx","npx skills add jmagly\u002Faiwg --skill confusable-unicode-audit",{"tool":97,"command":98},"bunx","bunx skills add jmagly\u002Faiwg --skill confusable-unicode-audit",{"tool":100,"command":101},"pnpm","pnpm dlx skills add jmagly\u002Faiwg --skill confusable-unicode-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fconfusable-unicode-audit\u002FSKILL.md",true,[],[106,131,155,161,168,182],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":113,"publishedAt":55},"01M70QA0BSYJ49EES9V4RE8QH1","host-hardening","Read-only system hardening baseline and plan-first host hardening recommendations for SSH, Docker bind addresses, firewall persistence, datastores, exporters and audit retention.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[112],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[114,115,116,39,117,118,119,120,121,122,45,123,124,125,30,126,127,128,129,130],"host","host hardening","hardening","re","recommendations","remediation","plan","port","verification","access","only","retention","never","firewall","bind","secrets","request",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":141,"publishedAt":55},"01M70PNT2Z4HMZPRBTAF6073NN","exposure-analysis","Read-only firewall analysis and effective host exposure reconstruction for Docker published ports, UFW bypass, stale rules, CDN scope, IPv6 asymmetry and external probe allowlists.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fforensics\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[137,140],{"categoryNo":138,"categoryName":139,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[142,143,144,39,145,121,146,147,45,148,114,149,124,150,151,126,127,152,153,154],"exposure analysis","analysis","unknown","credentials","collection","ufw","ports","internet","local","scope","reconstruction","operator","write",{"skillNo":156,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":160,"publishedAt":55},"01M70P8QATMPKA78E4FT5D2TNA","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[159],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[116,114,115,123,39,130,119,118,30,120,121,122,45,129,124,125,117,126,127,128],{"skillNo":162,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":167,"publishedAt":55},"01M70NMPVJ5H0JH131P60FW4R8","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[165,166],{"categoryNo":138,"categoryName":139,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[143,142,126,145,121,146,45,144,114,149,124,150,151,39,127,148,147,152,153,154],{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":175,"publishedAt":55},"01M6CB4DDR0B4NNCFK7ZK7449H","fixture-skill","Exercise rule delivery.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Frule-delivery\u002Fskills\u002Ffixture-skill\u002FSKILL.md",[174],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[176,177,178,179,180,181],"fixture skill","fixture","rule","delivery","true","exercise",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":189,"publishedAt":55},"01M6CB4AVK1W76MFMPP0JP32CJ","pi-local","Pi-local duplicate-precedence fixture.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Fproviders\u002Fpi\u002Fproject\u002F.pi\u002Fskills\u002Fpi-local\u002FSKILL.md",[188],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[190,191,150,192,177],"pi","pi local","duplicate"]