What happens
A SKILL.md whose only notable content is a family emoji (👨👩👧, a ZWJ sequence) fires SD-002 (Prompt Injection) as critical: "invisible Unicode character(s) detected". Because grading is worst-finding-wins, the skill's security axis drops to F. Meanwhile plain-text override phrasing in the same fixture produces no finding, so the outcome reads as inverted.
Repro: a skill directory with
---
name: emoji
description: d
---
Family: 👨👩👧 and flag 🏳️🌈 are fine.
Proposal
Do not count U+200D (ZERO WIDTH JOINER) as an invisible character when it sits inside a valid emoji ZWJ sequence — between two emoji code points, or per emoji-zwj-sequences.txt. Keep U+200B, U+200C, U+2060, mid-text U+FEFF and tag characters U+E0000–U+E007F as they are. The rule's documented accepted false positive ("legitimate emoji sequences near the bounded zero-width joiner heuristic") stays true for edge cases; the common case stops grading F.
Downstream: needs a release and the usual pin bumps in consumers.
What happens
A
SKILL.mdwhose only notable content is a family emoji (👨👩👧, a ZWJ sequence) fires SD-002 (Prompt Injection) as critical: "invisible Unicode character(s) detected". Because grading is worst-finding-wins, the skill's security axis drops to F. Meanwhile plain-text override phrasing in the same fixture produces no finding, so the outcome reads as inverted.Repro: a skill directory with
Proposal
Do not count U+200D (ZERO WIDTH JOINER) as an invisible character when it sits inside a valid emoji ZWJ sequence — between two emoji code points, or per
emoji-zwj-sequences.txt. Keep U+200B, U+200C, U+2060, mid-text U+FEFF and tag characters U+E0000–U+E007F as they are. The rule's documented accepted false positive ("legitimate emoji sequences near the bounded zero-width joiner heuristic") stays true for edge cases; the common case stops grading F.Downstream: needs a release and the usual pin bumps in consumers.