/test-invisible-chars

Generates 10+ adversarial variants of a prompt injection attempt using evasion techniques like homoglyphs and leetspeak, tests safety scanner detection, and reports overall rate plus evaded variants.

Scans files, directories, skills, plugins, MCP tools, or RAG documents for prompt injection, PII harvesting, credential theft, supply chain attacks, and invisible characters. Supports deep AI analysis, auto-fixes, and report output.

Paper tests code files with a 3-agent team (Happy Path Validator, Edge Case Hunter, Red Team Attacker) that debates findings and produces a prioritized flaw report.

Audits pasted text for hallucination triggers like speculation language, unverified causality, pseudo-quantification, and overreach claims, outputting Pass/Fail with quotes and rewrites.

Performs quick fake code detection audit for non-functional patterns using light analysis (4 thoughts), identical to /fake but faster, with remediation guidance.

Validates bash/shell code blocks in plugin markdown command/skill files or specified paths/directories using static analysis (bash -n, shellcheck), safety tiering, safe execution for green-tier, and AI review. Outputs report or JSON with --json.