homoglyph-detector
Byte-level Unicode homoglyph detection for identifying invisible character substitutions in code
npx skills add a5c-ai/babysitter --skill homoglyph-detector --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Homoglyph Detector Byte-level forensic analysis of code changes to detect Unicode homoglyph substitutions — characters that look identical to ASCII in every editor and diff tool but have different codepoints, silently breaking string comparisons, dictionary lookups, and identifier resolution. ## Purpose Homoglyph attacks (related to CVE-2021-42574 "Trojan Source") are the highest-stealth trojan technique. A Cyrillic `р` (U+0440) looks identical to a Latin `p` (U+0070) in every font, editor, and diff viewer. The only way to detect it is byte-level analysis via `hexdump`. This skill pipes git diffs through `hexdump -C` and scans for multi-byte UTF-8 sequences where single-byte ASCII is expected, particularly in string literals used as dictionary keys, variable names, and identifiers. ## Capabilities ### Confusable Character Detection Scans for these high-risk Unicode confusables: | Latin | Cyrillic | Greek | UTF-8 Bytes | |-------|----------|-------|-------------| | a (61) | а (D0 B0) | α (CE B1) | 1 vs 2 bytes | | c (63) | с (D1 81) | — | 1 vs 2 bytes | | e (65) | е (D0 B5) | ε (CE B5) | 1 vs 2 bytes | | o (6F) | о (D0 BE) | ο (CE BF) | 1 vs 2 bytes | | p (70) | р (D1 80) | ρ (CF
- Purpose
- Capabilities
- Confusable Character Detection
- Zero-Width Character Detection
- Bidi Control Character Detection (Trojan Source)
- Context-Aware Analysis
- Input Schema
- Output Schema
- Detection Method
- Usage Example
- Real-World Example
- Process Files
Step 1: Pipe git diff through hexdump git diff <file> | hexdump -C Step 2: In added (+) lines, look for multi-byte sequences where the removed (-) line had single-byte ASCII Example — Latin 'p' vs Cyrillic 'р': The d1 80 bytes where 70 should be = HOMOGLYPH DETECTED
What does the homoglyph-detector skill do?
Byte-level Unicode homoglyph detection for identifying invisible character substitutions in code
How do I install it?
Run `npx skills add a5c-ai/babysitter --skill homoglyph-detector --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From a5c-ai/babysitter, a repository with 1,642 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.