unicode-security

Mojibake is a low-level Unicode library written in C11.

AI-detector auditing toolkit: measures how often a detector flags genuine human writing, how stable its verdict is across seeds, and whether that verdict survives meaning-preserving edits. Detector-in-the-loop measurement harness. Claude Code skill + Python CLI. MIT.

The world's first font-by-font confusables dataset: which Unicode characters look alike, measured from the outlines of 322 fonts at the size people read them. CC BY, used in Mozilla's add-on name checks.

Strip invisible Unicode (U+200B zero-width space, U+00A0 NBSP, curly quotes) from clipboard text. 从复制粘贴里筛掉隐形字符，解决飞书/网页/AI聊天复制代码报 stray '\342'、IndentationError、VLOOKUP 匹配不上的问题

Research-only AI watermark & provenance robustness toolkit: local reverse proxy (OpenAI/Anthropic/Gemini) + CLI stripping C2PA/EXIF/XMP, zero-width & homoglyph Unicode, KGW text watermarks, DWT/Tree-Ring image stego, AudioSeal, PDF/DOCX/PPTX/XLSX metadata, and Trojan Source (CVE-2021-42574) code scanning.

Unicode Homoglyph Detector — Offensive Unicode Security Analysis

A specialized tool that generates highly obfuscated BIP custom derivation paths and passphrases. It uses layered noise (emojis, multi-script characters, and controlled entropy) to create an additional hidden (plausible deniability) protection layer in case a mnemonic seed is exposed

Reveal and remove hidden Unicode such as zero-width spaces, look-alike whitespace, and bidi controls. Runs locally.

Detect, decode and remove hidden Unicode: invisible text, ASCII smuggling, homoglyphs, Trojan Source bidi and prompt injection. Python library, CLI and GitHub Action for LLM, code and AI agent security.

SMUGGLR is a browser-based Unicode steganography and text obfuscation toolkit for experimenting with invisible characters, homoglyphs, whitespace ciphers, and Unicode-based payload hiding techniques — all fully client-side with zero network calls. 🔓

Detect and neutralize Unicode concealment codepoints in MCP tool metadata (covert-channel control). AGPL-3.0-or-later.

Zero-dependency heuristic scanner for prompt-injection indicators in untrusted text, for the boundary of LLM agent pipelines.

Deterministic offline scanner for repositories and package artifacts, detecting prompt injection, refusal bait, Trojan Source, obfuscation, and supply-chain anti-analysis before AI code review.

Audit whether an AI tool approval view faithfully represents its raw payload.

'İGNORE'.lower() != 'ignore'. Turkish case-folding & Unicode confusables bypass naive prompt-injection filters 94.6% of the time — measured, with dataset + a one-line NFKC fix.

Phishing-domain detection from Certificate Transparency logs, with a measured false-positive rate. Deterministic: UTS#39 homoglyph skeletons, weighted edit distance, combosquat segmentation. No ML.

Unicode Spoof and Homoglyph Detection for MoonBit (UTS #39)

Complete list of invisible Unicode characters as JSON: zero-width spaces, bidi controls, tag characters, variation selectors — with risk levels and recommended handling. Powers watermarkcheck.com

Zero-dependency static analysis scanner for detecting Trojan Source bidirectional overrides, mixed-script homographs, and invisible Unicode prompt-injection payloads in source code.

SE·EMU is a browser-based social engineering simulation designed to help cybersecurity learners understand and practice the human side of offensive security.