utilpeek: inspect a text for hidden or look-alike Unicode
text_unicode_inspectDetect invisible, bidi, and homoglyph Unicode characters in text to reveal prompt-injection smuggling, Trojan Source attacks, and mixed-script confusables, with risk level and positions.
Instructions
utilpeek: Find invisible, bidi and homoglyph Unicode characters in text. For injected instructions use check_text_for_prompt_injection. Returns a security-oriented Unicode inspection: risk (low / medium / high) with reasons; invisible characters (zero-width, tag characters that can smuggle prompt-injection text, controls) with positions; bidi controls (Trojan Source, CVE-2021-42574); UTS #39 confusables and mixed-script words (pаypal with a Cyrillic а); combining-mark floods; scripts and normalization status; optionally the text normalized or with invisible characters stripped. Typically under 1 s. Price: USD 0.001. Free: 10 utilpeek calls per IP per UTC day. The submitted text is never logged or stored. Docs: https://tanod.dev/learn/detect-ascii-smuggling-invisible-unicode-api.html
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | The text (at most 200,000 characters). | |
| skeleton | No | UTS #39 confusable skeleton of the whole text. | |
| normalize | No | Also return the text in this normalization form: NFC, NFD, NFKC or NFKD (default none). | |
| list_chars | No | List the first N code points with name / category. | |
| strip_invisible | No | Return the text without bidi / zero-width / tag / control characters. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| bidi | No | ||
| risk | No | ||
| text | No | ||
| error | No | Only on an error result: an object {code, message}, or the reason string of an x402 PaymentRequired object. | |
| length | No | ||
| source | No | ||
| reasons | No | ||
| scripts | No | ||
| skeleton | No | ||
| combining | No | ||
| invisible | No | ||
| categories | No | ||
| utf8_bytes | No | ||
| confusables | No | ||
| utf16_units | No | ||
| normalization | No | ||
| unicode_version | No | ||
| mixed_script_text | No | ||
| mixed_script_words | No |