Skills System

A threat actor with Skill-authoring credentials at a mid-sized firm crafts an instruction body for the 'NDA Review — MENA Counterparties' Skill. They insert U+202E (RIGHT-TO-LEFT OVERRIDE) immediately before the word 'disclose'. …

The system detects the presence of U+202E (and any other Unicode bidi control characters: U+202A, U+202B, U+202C, U+202D, U+2066, U+2067, U+2068, U+2069, U+200F, U+200E, U+061C) in the instruction body at save time and either (a) rejects the save with an HTTP 4xx response whose body identifies the …

A Knowledge Manager creates two versions of a French-language clause validation Skill. Version A instruction body contains 'résilié' using NFC-precomposed é (U+00E9, UTF-8 bytes C3 A9). Version B was copy-pasted from a macOS text…

The system stores versions A and B as byte-distinct objects with distinct version identifiers and distinct SHA-256 digests (since the UTF-8 bytes differ: C3 A9 vs 65 CC 81). When the agent resolves version A by its digest, it retrieves exactly the NFC bytes (C3 A9) and assembles the prompt with tho…

Firm scope already contains an active skill named 'NDA Review' (id: skill_7a3b, authored by KM-Alice, last modified 2026-03-10). A second Knowledge Manager submits a request to create a new firm-scoped skill also named 'NDA Revie…

The agent rejects the creation before writing any new skill record. The rejection response: (1) names the conflict explicitly — 'A skill named NDA Review already exists at firm scope'; (2) provides the existing skill's ID (skill_7a3b) and last-modified date; (3) offers at least two concrete resolut…