Fix instruction file contains text a human reader cannot see in Claude Code

An agent instruction file holds zero-width characters, a bidirectional override, or Unicode tag characters. The model reads the bytes; the reviewer reads the rendering. When those disagree, review is not review. The finding renders the run as escaped codepoints and never reproduces it.

high likely Claude Code CWE-838 / ASI ASI01

The vulnerable pattern in Claude Code

This finding comes from the Claude Code fixture in the owlwarden test suite. The model reads these 3 character(s); a reviewer reading this file sees nothing there. An instruction hidden this way is an instruction nobody approved.

The corrected configuration

Strip them from `CLAUDE.md` and from anything under `.claude/agents/` or `.claude/skills/`, then add a CI check so the next one fails a pull request rather than reaching a session.

// scripts/check-instructions.mjs - fail on any C0/format character outside \n and \t

If you are not using Claude Code

Delete the invisible characters. Then find out how they got in: a paste from a web page is the innocent explanation, and a commit that added them alone is not.

Check your own repository

npx owlwarden scan
npx owlwarden explain agent-instructions-hidden-text

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other Claude Code checks

Rules with a tested Claude Code example.

• agent-config-env-redirect high Repository config redirects the agent's API traffic
• agent-config-loader-script high Executable script inside an agent or editor config directory
• agent-config-secret-reachable high Repository config puts credentials in reach of a repository-controlled command
• agent-hook-autoexec high Repository config executes a command when the workspace is opened
• agent-hook-untrusted-command high Hook command reaches outside the project
• agent-instructions-directive medium Instruction file tells the agent to bypass its own controls
• agent-marketplace-untrusted medium Repository config adds a third-party plugin or skill source
• agent-mcp-unpinned-remote medium MCP server declaration resolves code at run time
• agent-permission-wildcard medium Repository config pre-approves a broad tool permission

agent-instructions-hidden-text for every agent host / All rules / owlwarden