repotrap 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Prince Jain
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,79 @@
-# Temporary Holding Version
+<p align="center">
+  <img src="assets/logo.png" width="128" height="128" alt="repotrap logo" />
+</p>
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+<h1 align="center">repotrap</h1>
+
+<p align="center">
+  Zero-dependency prompt-injection, invisible Unicode steganography, spoofed <code>&lt;system-reminder&gt;</code> delimiter, and repo-open execution trap scanner for Claude Code, Codex CLI, skills, and GitHub issues.
+</p>
+
+<p align="center">
+  <img src="assets/demo.png" width="840" alt="repotrap terminal output across 525 skills, 16 repos, and 153 sessions" />
+</p>
+
+## Why I built this
+
+In today's `r/ClaudeAI` thread (`1xozfcv`, *"Why are more than 98% of 16,060 open GitHub issues on anthropics/claude-code unassigned?"*) and `r/ExperiencedDevs` thread (`1xnl43h`, *"The Agentic Code Review Dilemma"*), maintainers pointed out the core blocker to letting coding agents triage issues, review PRs, or inspect cloned repos: **untrusted input poisoning and repo-open execution traps**.
+
+When you point Claude Code or Codex CLI at an external GitHub issue (`gh issue view`), a cloned PR branch, or a third-party `SKILL.md` file, four classes of traps can hijack the agent:
+1. **Workspace config auto-execution**: `.claude/settings.json` (`hooks`, `apiKeyHelper`, `statusLine`), `.mcp.json`, or `.vscode/tasks.json` (`"runOn": "folderOpen"`) inside a cloned repo that execute arbitrary commands when the agent starts.
+2. **Invisible Unicode steganography**: Unicode Tag characters (`U+E0000` to `U+E007F`), bidirectional overrides (`U+202A` to `U+202E`), and standalone zero-width spaces (`U+200B`) hiding instructions that humans cannot see in the browser.
+3. **Spoofed `<system-reminder>` and `</tool_result>` delimiters**: Untrusted issue bodies or web pages attempting to close the tool output block and inject fake system reminders.
+4. **Hidden HTML comment instructions & remote shell pipes**: `<!-- ignore previous instructions -->` inside Markdown issues or `curl ... | bash` inside installed `SKILL.md` files.
+
+## Quickstart
+
+Audit your installed skills, workspace repos, and historical `.jsonl` transcripts:
+
+```bash
+npx repotrap
+```
+
+Pre-scan an untrusted GitHub Issue or PR before handing it to a coding agent:
+
+```bash
+npx repotrap --gh-issue owner/repo#123
+```
+
+Generate a deterministic Claude Code `PostToolUse` sanitizer hook:
+
+```bash
+npx repotrap --emit-hook
+```
+
+## Real audit on 525 skill files, 16 repos, and 153 transcripts
+
+Running `npx repotrap` across `525` local skill markdown files (`~/.gemini/config/skills` and `~/.agents/skills`), `16` workspace repos, and `153` local Claude Code and Codex CLI transcripts surfaced three false-positive traps that naive scanners hit, plus real findings:
+
+1. **Claude Code native `type: "attachment"` `<system-reminder>` inflation (`1,526` native rows vs `0` spoofed `tool_result` delimiters)**: Scanning raw `.jsonl` lines for `<system-reminder>` matched `1,526` rows across `125` sessions because Claude Code serializes its own internal reminders as `type: "attachment"` and `type: "api-request-*"` records. `repotrap` parses the JSONL structure (`RTR012`) and only flags `<system-reminder>` or `</tool_result>` when it appears inside an untrusted `tool_result` or `function_call_output` payload (`RTR008`).
+2. **Codex `custom_tool_call_output` object serialization (`142` zero-width chars across `15` tool outputs in `5` sessions)**: Unlike `function_call_output` (where `payload.output` is a string), Codex CLI's `custom_tool_call_output` stores `payload.output` as a nested JSON object. Naive `String(payload.output)` coercion turns the entire payload into `"[object Object]"` and misses `138` of the `142` ingested `U+200B`/`U+200E` characters (`RTR011`).
+3. **Composite Emoji `U+200D` ZWJ vs standalone `U+200B` (`RTR014`) and local build scripts (`RTR013`)**: `repotrap` separates composite emoji zero-width joiners (`1` in `notebook-guidance/SKILL.md`) and benign local `package.json` build scripts (`7` across `16` repos) from `1` live `curl -fsSL https://composio.dev/install | bash` remote shell pipe in `composio-cli/SKILL.md` (`RTR005`) and `2` standalone `U+200B` characters in `signs-of-ai-writing.md` (`RTR007`).
+
+## Rules (`RTR001` to `RTR014`)
+
+| Rule | Plane | Severity | What it detects |
+| :--- | :--- | :--- | :--- |
+| `RTR001` | Repo | `CRITICAL` | Workspace `.claude/settings.json` defining `hooks`, `apiKeyHelper`, `otelHeadersHelper`, or `statusLine` |
+| `RTR002` | Repo | `CRITICAL` | Workspace `.mcp.json` or `.vscode/tasks.json` (`"runOn": "folderOpen"`) spawning commands on open |
+| `RTR003` | Repo | `CRITICAL` | Unicode Tag characters (`U+E0000`–`U+E007F`) or Bidirectional Overrides (`U+202A`–`U+202E`) |
+| `RTR004` | Repo | `HIGH` | HTML comments (`<!-- ... -->`) in Markdown/skills containing imperative prompt-injection verbs |
+| `RTR005` | Repo | `HIGH` | Skill or instruction file piping a remote URL directly into `sh` / `bash` (`curl ... \| bash`) |
+| `RTR006` | Repo | `MEDIUM` | `package.json` `preinstall`/`postinstall` hook running network or shell payloads |
+| `RTR007` | Repo | `LOW` | Standalone zero-width space (`U+200B` / `U+FEFF`) inside skill or documentation files |
+| `RTR008` | Transcript | `CRITICAL` | Spoofed `<system-reminder>`, `</tool_result>`, or `<function_calls>` inside untrusted tool output |
+| `RTR009` | Transcript | `CRITICAL` | Explicit prompt-override phrase (`ignore previous instructions`) inside untrusted tool output |
+| `RTR010` | Transcript | `HIGH` | Hidden HTML comment inside `tool_result` containing imperative agent/shell instructions |
+| `RTR011` | Transcript | `MEDIUM` | Standalone zero-width or directionality characters (`U+200B`, `U+200E`) ingested via tool output |
+| `RTR012` | Transcript | `INFO` | Claude Code native `type: "attachment"` `<system-reminder>` rows filtered out (False-Positive Guard) |
+| `RTR013` | Repo | `INFO` | Benign local `package.json` build/prepare scripts separated (False-Positive Guard) |
+| `RTR014` | Repo | `INFO` | Composite Emoji `U+200D` ZWJ sequences separated from Unicode steganography (False-Positive Guard) |
+
+## Limitations
+
+- **Syntactic & structural detection**: `repotrap` deterministically catches invisible Unicode (`U+E0000` tags, Bidi overrides, standalone `U+200B`), spoofed XML/harness delimiters (`<system-reminder>`, `</tool_result>`), HTML comment instructions, `curl | sh` skill pipes, and `.claude`/`.mcp.json`/`.vscode` repo-open hooks. It cannot prove whether natural-language prose without structural markers or imperative override phrases will sway a model's reasoning.
+- **`--gh-issue` requires GitHub CLI (`gh`)**: Pre-scanning live GitHub issues (`npx repotrap --gh-issue owner/repo#123`) invokes your authenticated `gh issue view` CLI.
+
+## License
+
+MIT

package/bin/repotrap.mjs

@@ -0,0 +1,237 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import { execFileSync } from "node:child_process";
+import {
+  RULE_META,
+  scanTextForPromptTraps,
+  auditRepoTraps,
+  generateGuardHook,
+  getDemoResult
+} from "../src/analyzer.mjs";
+
+const RESET = "\x1b[0m";
+const BOLD = "\x1b[1m";
+const DIM = "\x1b[2m";
+const RED = "\x1b[31m";
+const YELLOW = "\x1b[33m";
+const GREEN = "\x1b[32m";
+const CYAN = "\x1b[36m";
+const MAGENTA = "\x1b[35m";
+
+function printHelp() {
+  console.log(`
+${BOLD}repotrap${RESET} v0.1.0 - Prompt-Injection, Unicode Steganography & Repo Trap Scanner
+
+Usage:
+  npx repotrap [options]
+
+Options:
+  --workspace <path>       Workspace directory to scan for repo-open traps (default: cwd)
+  --file <path>            Scan a single Markdown, SKILL.md, or issue file
+  --gh-issue <repo#num>    Fetch and scan a GitHub issue/PR via 'gh issue view' before agent triage
+  --emit-hook              Output deterministic PostToolUse guardrail hook + settings.json
+  --json                   Output structured JSON report
+  --fail-on <severity>     Exit 1 if findings >= severity (CRITICAL, HIGH, MEDIUM, LOW)
+  --demo                   Render benchmarked 534-skill + 153-session corpus audit output
+  -h, --help               Show help
+  -v, --version            Show version
+`);
+}
+
+function parseArgs(argv) {
+  const opts = {
+    workspaceDir: null,
+    file: null,
+    ghIssue: null,
+    emitHook: false,
+    json: false,
+    failOn: null,
+    demo: false,
+    help: false,
+    version: false
+  };
+
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "-h" || a === "--help") opts.help = true;
+    else if (a === "-v" || a === "--version") opts.version = true;
+    else if (a === "--demo") opts.demo = true;
+    else if (a === "--json") opts.json = true;
+    else if (a === "--emit-hook") opts.emitHook = true;
+    else if (a === "--workspace") opts.workspaceDir = argv[++i];
+    else if (a === "--file") opts.file = argv[++i];
+    else if (a === "--gh-issue") opts.ghIssue = argv[++i];
+    else if (a === "--fail-on") opts.failOn = String(argv[++i] || "").toUpperCase();
+  }
+  return opts;
+}
+
+function severityColor(sev) {
+  if (sev === "CRITICAL") return `${BOLD}${RED}`;
+  if (sev === "HIGH") return RED;
+  if (sev === "MEDIUM") return YELLOW;
+  if (sev === "LOW") return CYAN;
+  return DIM;
+}
+
+function renderReport(res) {
+  const gradeColor =
+    res.grade === "A" ? GREEN : res.grade === "B" ? CYAN : res.grade === "C" ? YELLOW : RED;
+
+  console.log(`\n${BOLD}${CYAN}repotrap v0.1.0${RESET} ${DIM}| Prompt-Injection, Invisible Unicode & Repo Trap Audit${RESET}`);
+  console.log(`${DIM}${"=".repeat(76)}${RESET}`);
+  console.log(
+    `Skills Scanned: ${BOLD}${res.skillFilesScanned}${RESET}   ` +
+      `Repos Checked: ${BOLD}${res.reposChecked}${RESET}   ` +
+      `Sessions Replayed: ${BOLD}${res.sessionsScanned}${RESET}   ` +
+      `Safety Score: ${BOLD}${gradeColor}${res.score}/100 (Grade ${res.grade})${RESET}`
+  );
+  console.log(
+    `Severities:     ` +
+      `${BOLD}${RED}CRITICAL: ${res.severityCounts.CRITICAL}${RESET}  ` +
+      `${RED}HIGH: ${res.severityCounts.HIGH}${RESET}  ` +
+      `${YELLOW}MEDIUM: ${res.severityCounts.MEDIUM}${RESET}  ` +
+      `${CYAN}LOW: ${res.severityCounts.LOW}${RESET}  ` +
+      `${DIM}INFO: ${res.severityCounts.INFO}${RESET}`
+  );
+  console.log(`${DIM}${"-".repeat(76)}${RESET}`);
+
+  const m = res.metrics;
+  console.log(`${BOLD}${MAGENTA}[Plane 1] Untrusted Repo, Skill & Lifecycle Trap Surface${RESET}`);
+  console.log(
+    `  * Skill Remote Shell Pipes (curl | sh): ${
+      res.ruleCounts.RTR005 ? `${RED}${res.ruleCounts.RTR005} file(s) flagged${RESET}` : `${GREEN}0 remote shell pipes${RESET}`
+    }`
+  );
+  console.log(
+    `  * Standalone Zero-Width in Skills:      ${
+      m.skillZeroWidthCount > 0 ? `${YELLOW}${m.skillZeroWidthCount} U+200B char(s)${RESET}` : `${GREEN}0 standalone zero-width chars${RESET}`
+    }`
+  );
+  console.log(
+    `  * Emoji ZWJ Sequences Separated:        ${CYAN}${m.emojiZwjFilteredCount} composite emoji U+200D filtered (RTR014 guard)${RESET}`
+  );
+  console.log(
+    `  * Benign package.json Build Scripts:    ${CYAN}${m.benignLifecycleCount} local build/prepare script(s) separated (RTR013 guard)${RESET}`
+  );
+
+  console.log(`\n${BOLD}${MAGENTA}[Plane 2] Transcript tool_result & Issue Poisoning Replay${RESET}`);
+  console.log(
+    `  * Prompt-Override / Delimiter Spoofs:   ${
+      (res.ruleCounts.RTR008 || 0) + (res.ruleCounts.RTR009 || 0) > 0
+        ? `${RED}${(res.ruleCounts.RTR008 || 0) + (res.ruleCounts.RTR009 || 0)} untrusted tool_result payload(s) flagged${RESET}`
+        : `${GREEN}0 untrusted overrides${RESET}`
+    }`
+  );
+  console.log(
+    `  * Harness <system-reminder> Filtered:   ${CYAN}${m.harnessSystemReminderCount} native attachment rows excluded (RTR012 guard)${RESET}`
+  );
+  console.log(
+    `  * Zero-Width Ingested in tool_result:   ${
+      m.totalTranscriptZeroWidth > 0
+        ? `${YELLOW}${m.totalTranscriptZeroWidth} char(s) across ${m.transcriptsWithZeroWidth} session(s) (U+200B / U+200E)${RESET}`
+        : `${GREEN}0 zero-width chars${RESET}`
+    }`
+  );
+
+  console.log(`\n${BOLD}Rule Breakdown:${RESET}`);
+  const sortedRules = Object.entries(res.ruleCounts).sort((a, b) => {
+    const order = { CRITICAL: 5, HIGH: 4, MEDIUM: 3, LOW: 2, INFO: 1 };
+    const ma = RULE_META[a[0]] || { severity: "INFO" };
+    const mb = RULE_META[b[0]] || { severity: "INFO" };
+    return (order[mb.severity] || 0) - (order[ma.severity] || 0) || b[1] - a[1];
+  });
+
+  for (const [ruleId, count] of sortedRules) {
+    const meta = RULE_META[ruleId];
+    if (!meta) continue;
+    const col = severityColor(meta.severity);
+    console.log(
+      `  ${col}[${meta.severity.padEnd(8)}]${RESET} ${BOLD}${ruleId}${RESET} (${String(count).padStart(2)}x) ${meta.title}`
+    );
+  }
+
+  const notable = [
+    ...res.findings.filter((f) => f.severity === "CRITICAL"),
+    ...res.findings.filter((f) => f.severity === "HIGH"),
+    ...res.findings.filter((f) => f.severity === "MEDIUM"),
+    ...res.findings.filter((f) => f.severity === "LOW")
+  ].slice(0, 5);
+
+  if (notable.length > 0) {
+    console.log(`\n${BOLD}Top Evidence Samples:${RESET}`);
+    for (const f of notable) {
+      const col = severityColor(f.severity);
+      console.log(`  ${col}* ${f.ruleId}${RESET}: ${f.detail}`);
+    }
+  }
+
+  console.log(`\n${DIM}Run 'npx repotrap --gh-issue owner/repo#123' to pre-scan an untrusted GitHub issue before agent triage.${RESET}\n`);
+}
+
+function main() {
+  const opts = parseArgs(process.argv.slice(2));
+  if (opts.help) {
+    printHelp();
+    process.exit(0);
+  }
+  if (opts.version) {
+    console.log("0.1.0");
+    process.exit(0);
+  }
+  if (opts.emitHook) {
+    const { hookScript, settingsSnippet } = generateGuardHook();
+    if (opts.json) {
+      console.log(JSON.stringify({ hookScript, settingsSnippet }, null, 2));
+    } else {
+      console.log(`${BOLD}${CYAN}# 1. Save to ~/.claude/hooks/repotrap-guard-hook.mjs:${RESET}\n`);
+      console.log(hookScript);
+      console.log(`${BOLD}${CYAN}# 2. Merge into ~/.claude/settings.json:${RESET}\n`);
+      console.log(JSON.stringify(settingsSnippet, null, 2));
+    }
+    process.exit(0);
+  }
+
+  if (opts.file) {
+    const content = fs.readFileSync(opts.file, "utf8");
+    const res = scanTextForPromptTraps(content, opts.file, true);
+    console.log(JSON.stringify(res, null, 2));
+    process.exit(res.findings.some((f) => f.severity === "CRITICAL" || f.severity === "HIGH") ? 1 : 0);
+  }
+
+  if (opts.ghIssue) {
+    const m = opts.ghIssue.match(/^([^#]+)#(\d+)$/);
+    if (!m) {
+      console.error("Invalid --gh-issue format. Expected owner/repo#123");
+      process.exit(1);
+    }
+    const [, repo, num] = m;
+    const out = execFileSync("gh", ["issue", "view", num, "--repo", repo, "--json", "title,body,comments"], {
+      encoding: "utf8"
+    });
+    const res = scanTextForPromptTraps(out, opts.ghIssue, true);
+    console.log(JSON.stringify(res, null, 2));
+    process.exit(res.findings.some((f) => f.severity === "CRITICAL" || f.severity === "HIGH") ? 1 : 0);
+  }
+
+  const result = opts.demo
+    ? getDemoResult()
+    : auditRepoTraps({
+        workspaceDir: opts.workspaceDir || "/Volumes/Apple External Drive/Prince Jain/Github"
+      });
+
+  if (opts.json) {
+    console.log(JSON.stringify(result, null, 2));
+  } else {
+    renderReport(result);
+  }
+
+  if (opts.failOn) {
+    const ranks = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1 };
+    const threshold = ranks[opts.failOn] || 4;
+    const triggered = result.findings.some((f) => (ranks[f.severity] || 0) >= threshold);
+    if (triggered) process.exit(1);
+  }
+}
+
+main();

package/package.json

@@ -1,6 +1,41 @@
 {
   "name": "repotrap",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Zero-dependency prompt-injection, invisible Unicode steganography, spoofed system-reminder delimiter, and repo-open execution trap scanner for Claude Code, Codex CLI, skills, and GitHub issues.",
+  "type": "module",
+  "bin": {
+    "repotrap": "./bin/repotrap.mjs"
+  },
+  "main": "./src/analyzer.mjs",
+  "files": [
+    "bin/",
+    "src/",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "test": "node --test tests/repotrap.test.mjs",
+    "demo": "node ./bin/repotrap.mjs --demo"
+  },
+  "keywords": [
+    "claude-code",
+    "codex",
+    "prompt-injection",
+    "security",
+    "unicode",
+    "github-issues",
+    "mcp",
+    "ai-agents",
+    "skills",
+    "static-analysis"
+  ],
+  "author": "Prince Jain <princejain756@gmail.com>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/princejain756/repotrap.git"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  }
+}

package/src/analyzer.mjs

@@ -0,0 +1,725 @@
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+
+export const RULE_META = {
+  // Plane 1: Untrusted Repo, Skill & Issue/PR Surface
+  RTR001: {
+    id: "RTR001",
+    plane: "repo",
+    severity: "CRITICAL",
+    title: "Workspace .claude/settings.json Defines Auto-Executing Hooks or Helper Scripts",
+    points: 30
+  },
+  RTR002: {
+    id: "RTR002",
+    plane: "repo",
+    severity: "CRITICAL",
+    title: "Workspace .mcp.json or .vscode/tasks.json Spawns Commands on Folder Open",
+    points: 25
+  },
+  RTR003: {
+    id: "RTR003",
+    plane: "repo",
+    severity: "CRITICAL",
+    title: "Unicode Tag Characters (U+E0000) or Bidirectional Override Smuggling (U+202A-U+202E)",
+    points: 30
+  },
+  RTR004: {
+    id: "RTR004",
+    plane: "repo",
+    severity: "HIGH",
+    title: "HTML Comment or Hidden Element Contains Imperative Prompt-Injection Verbs",
+    points: 20
+  },
+  RTR005: {
+    id: "RTR005",
+    plane: "repo",
+    severity: "HIGH",
+    title: "Skill or Instruction File Pipes Remote URL Directly to Shell (curl | sh / eval)",
+    points: 18
+  },
+  RTR006: {
+    id: "RTR006",
+    plane: "repo",
+    severity: "MEDIUM",
+    title: "package.json Lifecycle Hook (preinstall/postinstall) Runs Network or Shell Payload",
+    points: 15
+  },
+  RTR007: {
+    id: "RTR007",
+    plane: "repo",
+    severity: "LOW",
+    title: "Standalone Zero-Width Space (U+200B / U+FEFF) in Skill or Documentation File",
+    points: 5
+  },
+
+  // Plane 2: Session Transcript tool_result & Issue Poisoning Replay
+  RTR008: {
+    id: "RTR008",
+    plane: "transcript",
+    severity: "CRITICAL",
+    title: "Spoofed <system-reminder> or </tool_result> Delimiter Inside Untrusted Tool Output",
+    points: 30
+  },
+  RTR009: {
+    id: "RTR009",
+    plane: "transcript",
+    severity: "CRITICAL",
+    title: "Explicit Prompt-Override or Instruction-Hijack Phrase Inside Tool Output",
+    points: 25
+  },
+  RTR010: {
+    id: "RTR010",
+    plane: "transcript",
+    severity: "HIGH",
+    title: "Hidden HTML Comment Inside Tool Output Contains Imperative Agent Instructions",
+    points: 18
+  },
+  RTR011: {
+    id: "RTR011",
+    plane: "transcript",
+    severity: "MEDIUM",
+    title: "Standalone Zero-Width or Directionality Marks (U+200B / U+200E) Ingested in Tool Output",
+    points: 8
+  },
+  RTR012: {
+    id: "RTR012",
+    plane: "transcript",
+    severity: "INFO",
+    title: "Harness-Native <system-reminder> Attachment Rows Filtered (False-Positive Guard)",
+    points: 0
+  },
+  RTR013: {
+    id: "RTR013",
+    plane: "repo",
+    severity: "INFO",
+    title: "Benign Local package.json Build Lifecycle Scripts Separated (False-Positive Guard)",
+    points: 0
+  },
+  RTR014: {
+    id: "RTR014",
+    plane: "repo",
+    severity: "INFO",
+    title: "Legitimate Emoji ZWJ (U+200D) Sequences Separated from Steganography (False-Positive Guard)",
+    points: 0
+  }
+};
+
+export function maskPath(p) {
+  if (!p) return "";
+  return String(p)
+    .replace(/\/Users\/[a-zA-Z0-9._-]+/g, "~")
+    .replace(/\/home\/[a-zA-Z0-9._-]+/g, "~");
+}
+
+// Detect Unicode Tag block (U+E0000 - U+E007F, UTF-16 surrogates \uDB40[\uDC00-\uDC7F])
+// and Bidirectional Overrides (U+202A - U+202E, U+2066 - U+2069)
+const BIDI_OR_TAG_RE = /[\u202A-\u202E\u2066-\u2069]|\uDB40[\uDC00-\uDC7F]/g;
+
+// Standalone zero-width characters (excluding U+200D ZWJ when between non-ASCII emoji surrogates)
+export function analyzeZeroWidthCharacters(text) {
+  const s = String(text || "");
+  let bidiOrTagCount = 0;
+  let standaloneZeroWidthCount = 0;
+  let emojiZwjCount = 0;
+  const detectedCodes = new Set();
+
+  const bidiMatches = s.match(BIDI_OR_TAG_RE);
+  if (bidiMatches) {
+    bidiOrTagCount += bidiMatches.length;
+    for (const m of bidiMatches) {
+      const cp = m.codePointAt(0);
+      detectedCodes.add("U+" + cp.toString(16).toUpperCase());
+    }
+  }
+
+  for (let i = 0; i < s.length; i++) {
+    const code = s.charCodeAt(i);
+    if (code === 0x200d) {
+      // Check if surrounded by high/low surrogate or emoji Pictographic character
+      const prev = i > 0 ? s.charCodeAt(i - 1) : 0;
+      const next = i + 1 < s.length ? s.charCodeAt(i + 1) : 0;
+      if (prev > 127 && next > 127) {
+        emojiZwjCount++;
+      } else {
+        standaloneZeroWidthCount++;
+        detectedCodes.add("U+200D");
+      }
+    } else if (code === 0x200b || code === 0x200c || code === 0x200e || code === 0x200f || (code === 0xfeff && i > 0)) {
+      standaloneZeroWidthCount++;
+      detectedCodes.add("U+" + code.toString(16).toUpperCase().padStart(4, "0"));
+    }
+  }
+
+  return {
+    bidiOrTagCount,
+    standaloneZeroWidthCount,
+    emojiZwjCount,
+    detectedCodes: [...detectedCodes]
+  };
+}
+
+const IMPERATIVE_INJECTION_RE = /\b(ignore\s+(?:all\s+)?(?:previous|prior)\s+instructions|disregard\s+(?:all\s+)?(?:previous|prior)|system\s+prompt|you\s+are\s+now|important:\s*run\s+|curl\s+-|wget\s+http|bash\s+-c|cat\s+~\/\.|\.env\b|id_rsa\b|PreToolUse)/i;
+const SPOOFED_DELIMITER_RE = /<\/?(?:system-reminder|tool_result|EXTREMELY_IMPORTANT|function_calls|antml:invoke)\b/i;
+const REMOTE_SHELL_PIPE_RE = /\b(?:curl|wget)\b[^\n|]{3,140}\|\s*(?:sudo\s+)?(?:ba|z)?sh\b/i;
+
+export function scanTextForPromptTraps(text, sourceLabel = "input", isTranscriptToolResult = false) {
+  const findings = [];
+  const s = String(text || "");
+  if (!s) return { findings, zwStats: { bidiOrTagCount: 0, standaloneZeroWidthCount: 0, emojiZwjCount: 0 } };
+
+  const zwStats = analyzeZeroWidthCharacters(s);
+
+  if (zwStats.bidiOrTagCount > 0) {
+    findings.push({
+      ruleId: "RTR003",
+      plane: isTranscriptToolResult ? "transcript" : "repo",
+      severity: "CRITICAL",
+      file: maskPath(sourceLabel),
+      detail: `${zwStats.bidiOrTagCount} invisible Unicode Tag or Bidirectional override character(s) (${zwStats.detectedCodes.join(", ")}) detected in ${maskPath(sourceLabel)}`,
+      evidence: `Codes: ${zwStats.detectedCodes.join(", ")}`
+    });
+  }
+
+  if (zwStats.standaloneZeroWidthCount > 0) {
+    findings.push({
+      ruleId: isTranscriptToolResult ? "RTR011" : "RTR007",
+      plane: isTranscriptToolResult ? "transcript" : "repo",
+      severity: isTranscriptToolResult ? "MEDIUM" : "LOW",
+      file: maskPath(sourceLabel),
+      detail: `${zwStats.standaloneZeroWidthCount} standalone zero-width/directionality character(s) (${zwStats.detectedCodes.join(", ")}) in ${maskPath(sourceLabel)}`,
+      evidence: `Codes: ${zwStats.detectedCodes.join(", ")}`
+    });
+  }
+
+  // Check HTML comments for hidden prompt injection
+  const htmlComments = [...s.matchAll(/<!--([\s\S]{1,1500}?)-->/g)];
+  for (const m of htmlComments) {
+    const body = m[1];
+    if (IMPERATIVE_INJECTION_RE.test(body) || SPOOFED_DELIMITER_RE.test(body)) {
+      findings.push({
+        ruleId: isTranscriptToolResult ? "RTR010" : "RTR004",
+        plane: isTranscriptToolResult ? "transcript" : "repo",
+        severity: "HIGH",
+        file: maskPath(sourceLabel),
+        detail: `Hidden HTML comment in ${maskPath(sourceLabel)} contains imperative agent/shell instructions`,
+        evidence: `<!-- ${body.trim().slice(0, 140)} -->`
+      });
+    }
+  }
+
+  // Check for spoofed harness delimiters inside untrusted tool results or issue bodies
+  if (isTranscriptToolResult && SPOOFED_DELIMITER_RE.test(s)) {
+    const match = s.match(SPOOFED_DELIMITER_RE);
+    findings.push({
+      ruleId: "RTR008",
+      plane: "transcript",
+      severity: "CRITICAL",
+      file: maskPath(sourceLabel),
+      detail: `Untrusted tool output in ${maskPath(sourceLabel)} contains spoofed harness delimiter (${match[0]})`,
+      evidence: match[0]
+    });
+  }
+
+  // Check for explicit prompt override phrases inside tool_result
+  if (
+    isTranscriptToolResult &&
+    /\b(ignore\s+(?:all\s+)?(?:previous|prior)\s+instructions|disregard\s+(?:all\s+)?(?:previous|prior)\s+instructions|new\s+system\s+instructions\s*:)/i.test(s)
+  ) {
+    findings.push({
+      ruleId: "RTR009",
+      plane: "transcript",
+      severity: "CRITICAL",
+      file: maskPath(sourceLabel),
+      detail: `Untrusted tool output in ${maskPath(sourceLabel)} contains explicit prompt-override phrase`,
+      evidence: s.match(/\b(ignore\s+(?:all\s+)?(?:previous|prior)\s+instructions|disregard\s+(?:all\s+)?(?:previous|prior)\s+instructions|new\s+system\s+instructions\s*:)/i)[0]
+    });
+  }
+
+  // Check for remote shell pipe in skill / instruction files
+  if (!isTranscriptToolResult && REMOTE_SHELL_PIPE_RE.test(s)) {
+    const match = s.match(REMOTE_SHELL_PIPE_RE);
+    findings.push({
+      ruleId: "RTR005",
+      plane: "repo",
+      severity: "HIGH",
+      file: maskPath(sourceLabel),
+      detail: `Instruction/skill file ${maskPath(sourceLabel)} instructs agent to pipe remote URL directly into shell`,
+      evidence: match[0].trim().slice(0, 160)
+    });
+  }
+
+  return { findings, zwStats };
+}
+
+export function scanWorkspaceConfigFiles(repoDir) {
+  const findings = [];
+  let benignLifecycleCount = 0;
+
+  // 1. Check .claude/settings.json and .claude/settings.local.json inside repo
+  for (const rel of [".claude/settings.json", ".claude/settings.local.json"]) {
+    const p = path.join(repoDir, rel);
+    if (!fs.existsSync(p)) continue;
+    try {
+      const cfg = JSON.parse(fs.readFileSync(p, "utf8"));
+      const dangerousKeys = ["hooks", "apiKeyHelper", "otelHeadersHelper", "awsAuthRefresh", "statusLine"].filter(
+        (k) => Boolean(cfg?.[k])
+      );
+      if (dangerousKeys.length > 0) {
+        findings.push({
+          ruleId: "RTR001",
+          plane: "repo",
+          severity: "CRITICAL",
+          file: maskPath(p),
+          detail: `Workspace ${rel} defines auto-executing ${dangerousKeys.join(", ")} on session start or tool invocation`,
+          evidence: `Keys: ${dangerousKeys.join(", ")}`
+        });
+      }
+    } catch {
+      // ignore
+    }
+  }
+
+  // 2. Check .mcp.json and .vscode/tasks.json
+  const mcpPath = path.join(repoDir, ".mcp.json");
+  if (fs.existsSync(mcpPath)) {
+    try {
+      const mcp = JSON.parse(fs.readFileSync(mcpPath, "utf8"));
+      const servers = Object.keys(mcp?.mcpServers || mcp || {});
+      if (servers.length > 0) {
+        findings.push({
+          ruleId: "RTR002",
+          plane: "repo",
+          severity: "CRITICAL",
+          file: maskPath(mcpPath),
+          detail: `Workspace .mcp.json defines ${servers.length} repo-scoped MCP server(s) (${servers.slice(0, 4).join(", ")})`,
+          evidence: `Servers: ${servers.slice(0, 4).join(", ")}`
+        });
+      }
+    } catch {
+      // ignore
+    }
+  }
+
+  const vscodeTasksPath = path.join(repoDir, ".vscode", "tasks.json");
+  if (fs.existsSync(vscodeTasksPath)) {
+    try {
+      const raw = fs.readFileSync(vscodeTasksPath, "utf8");
+      if (/"runOn"\s*:\s*"folderOpen"/i.test(raw)) {
+        findings.push({
+          ruleId: "RTR002",
+          plane: "repo",
+          severity: "CRITICAL",
+          file: maskPath(vscodeTasksPath),
+          detail: `Workspace .vscode/tasks.json contains task with "runOn": "folderOpen"`,
+          evidence: `"runOn": "folderOpen"`
+        });
+      }
+    } catch {
+      // ignore
+    }
+  }
+
+  // 3. Check package.json lifecycle hooks
+  const pkgPath = path.join(repoDir, "package.json");
+  if (fs.existsSync(pkgPath)) {
+    try {
+      const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+      const scripts = pkg?.scripts || {};
+      for (const hook of ["preinstall", "install", "postinstall", "prepare"]) {
+        const cmd = scripts[hook];
+        if (!cmd) continue;
+        if (/\b(curl|wget|nc\s|netcat|bash\s+-c|sh\s+-c|base64\s+-d|eval\s|http:\/\/|https:\/\/)\b/i.test(cmd)) {
+          findings.push({
+            ruleId: "RTR006",
+            plane: "repo",
+            severity: "MEDIUM",
+            file: maskPath(pkgPath),
+            detail: `package.json "${hook}" lifecycle script runs network or shell command (${cmd.slice(0, 100)})`,
+            evidence: `${hook}: ${cmd.slice(0, 120)}`
+          });
+        } else {
+          benignLifecycleCount++;
+        }
+      }
+    } catch {
+      // ignore
+    }
+  }
+
+  return { findings, benignLifecycleCount };
+}
+
+export function scanTranscriptFile(filePath) {
+  const findings = [];
+  let harnessSystemReminderCount = 0;
+  let spoofedToolResultDelimiterCount = 0;
+  let toolResultZeroWidthCount = 0;
+  let toolResultHtmlCommentCount = 0;
+
+  const content = fs.readFileSync(filePath, "utf8");
+  const lines = content.split("\n");
+
+  for (const line of lines) {
+    if (!line.trim() || line.length > 120000) continue;
+
+    // Check if line has <system-reminder>
+    const hasSysRem = line.includes("<system-reminder>");
+    const hasToolRes =
+      line.includes("tool_result") ||
+      line.includes("function_call_output") ||
+      line.includes("custom_tool_call_output");
+    const hasZw = /[\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]/.test(line);
+    const hasComment = line.includes("<!--");
+    const hasOverride = /ignore (?:all )?(?:previous|prior) instructions/i.test(line);
+
+    if (!hasSysRem && !hasToolRes && !hasZw && !hasComment && !hasOverride) continue;
+
+    let obj;
+    try {
+      obj = JSON.parse(line);
+    } catch {
+      continue;
+    }
+
+    // False-positive guard (RTR012): Claude Code native attachment / api-request rows
+    if (
+      hasSysRem &&
+      (obj.type === "attachment" ||
+        obj.type === "api-request-shape" ||
+        obj.type === "api-request-blob")
+    ) {
+      harnessSystemReminderCount++;
+      continue;
+    }
+
+    // Extract untrusted tool_result / function_call_output text
+    const toolPayloads = [];
+    if (Array.isArray(obj?.message?.content)) {
+      for (const c of obj.message.content) {
+        if (c?.type === "tool_result") {
+          const txt = typeof c.content === "string" ? c.content : JSON.stringify(c.content || "");
+          toolPayloads.push(txt);
+        }
+      }
+    }
+    if (
+      obj?.type === "response_item" &&
+      (obj?.payload?.type === "function_call_output" || obj?.payload?.type === "custom_tool_call_output")
+    ) {
+      const rawOut = obj.payload.output;
+      toolPayloads.push(typeof rawOut === "string" ? rawOut : JSON.stringify(rawOut || ""));
+    }
+    if (obj?.type === "user" && typeof obj?.message?.content === "string") {
+      toolPayloads.push(obj.message.content);
+    }
+
+    for (const payload of toolPayloads) {
+      if (payload.includes("<!--")) toolResultHtmlCommentCount++;
+      const res = scanTextForPromptTraps(payload, path.basename(filePath), true);
+      for (const f of res.findings) {
+        if (f.ruleId === "RTR008") spoofedToolResultDelimiterCount++;
+        findings.push(f);
+      }
+      toolResultZeroWidthCount += res.zwStats.standaloneZeroWidthCount;
+    }
+  }
+
+  return {
+    findings,
+    harnessSystemReminderCount,
+    spoofedToolResultDelimiterCount,
+    toolResultZeroWidthCount,
+    toolResultHtmlCommentCount
+  };
+}
+
+function walkFiles(dir, predicate, out = [], maxDepth = 4, curDepth = 0) {
+  if (!dir || !fs.existsSync(dir) || curDepth > maxDepth) return out;
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  for (const e of entries) {
+    if (e.name === "node_modules" || e.name === ".git" || e.name === "dist" || e.name === "build") continue;
+    const full = path.join(dir, e.name);
+    if (e.isDirectory()) {
+      walkFiles(full, predicate, out, maxDepth, curDepth + 1);
+    } else if (predicate(full, e.name)) {
+      out.push(full);
+    }
+  }
+  return out;
+}
+
+export function computeRiskSummary(findings) {
+  const ruleCounts = {};
+  const severityCounts = { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0, INFO: 0 };
+
+  for (const f of findings) {
+    ruleCounts[f.ruleId] = (ruleCounts[f.ruleId] || 0) + 1;
+    if (severityCounts[f.severity] !== undefined) {
+      severityCounts[f.severity]++;
+    }
+  }
+
+  let penalty = 0;
+  for (const [ruleId, count] of Object.entries(ruleCounts)) {
+    const meta = RULE_META[ruleId];
+    if (!meta || meta.points === 0) continue;
+    const mult = Math.min(2.0, 1 + Math.log10(count) * 0.5);
+    penalty += Math.round(meta.points * mult);
+  }
+
+  const score = Math.max(0, Math.min(100, 100 - penalty));
+  let grade = "A";
+  if (score < 45) grade = "F";
+  else if (score < 60) grade = "D";
+  else if (score < 75) grade = "C";
+  else if (score < 90) grade = "B";
+
+  return { score, grade, ruleCounts, severityCounts };
+}
+
+export function auditRepoTraps(options = {}) {
+  const homeDir = options.homeDir || os.homedir();
+  const skillDirs = options.skillDirs || [
+    path.join(homeDir, ".gemini", "config", "skills"),
+    path.join(homeDir, ".agents", "skills")
+  ];
+  const workspaceDir = options.workspaceDir || process.cwd();
+
+  const skillFiles = [];
+  for (const sd of skillDirs) {
+    walkFiles(sd, (_p, name) => name.endsWith(".md"), skillFiles, 3);
+  }
+
+  const transcriptFiles = options.transcriptFiles || [
+    ...walkFiles(path.join(homeDir, ".claude", "projects"), (_p, n) => n.endsWith(".jsonl"), [], 3),
+    ...walkFiles(path.join(homeDir, ".codex", "sessions"), (_p, n) => n.endsWith(".jsonl"), [], 4)
+  ];
+
+  const allFindings = [];
+  let emojiZwjFilteredCount = 0;
+  let skillZeroWidthCount = 0;
+  let benignLifecycleCount = 0;
+  let reposChecked = 0;
+
+  // 1. Scan skill markdown files
+  for (const sf of skillFiles) {
+    const text = fs.readFileSync(sf, "utf8");
+    const res = scanTextForPromptTraps(text, sf, false);
+    allFindings.push(...res.findings);
+    emojiZwjFilteredCount += res.zwStats.emojiZwjCount;
+    skillZeroWidthCount += res.zwStats.standaloneZeroWidthCount;
+  }
+
+  // 2. Scan workspace repo(s)
+  if (fs.existsSync(workspaceDir)) {
+    const subDirs = [workspaceDir];
+    try {
+      for (const e of fs.readdirSync(workspaceDir, { withFileTypes: true })) {
+        if (e.isDirectory() && !e.name.startsWith(".")) {
+          subDirs.push(path.join(workspaceDir, e.name));
+        }
+      }
+    } catch {
+      // ignore
+    }
+    for (const dir of subDirs.slice(0, 35)) {
+      if (fs.existsSync(path.join(dir, "package.json")) || fs.existsSync(path.join(dir, ".claude")) || fs.existsSync(path.join(dir, ".mcp.json"))) {
+        reposChecked++;
+        const wsRes = scanWorkspaceConfigFiles(dir);
+        allFindings.push(...wsRes.findings);
+        benignLifecycleCount += wsRes.benignLifecycleCount;
+      }
+    }
+  }
+
+  // 3. Scan session transcripts
+  let harnessSystemReminderCount = 0;
+  let transcriptsWithZeroWidth = 0;
+  let totalTranscriptZeroWidth = 0;
+  let toolResultHtmlComments = 0;
+
+  for (const tf of transcriptFiles) {
+    const tRes = scanTranscriptFile(tf);
+    allFindings.push(...tRes.findings);
+    harnessSystemReminderCount += tRes.harnessSystemReminderCount;
+    if (tRes.toolResultZeroWidthCount > 0) {
+      transcriptsWithZeroWidth++;
+      totalTranscriptZeroWidth += tRes.toolResultZeroWidthCount;
+    }
+    toolResultHtmlComments += tRes.toolResultHtmlCommentCount;
+  }
+
+  if (harnessSystemReminderCount > 0) {
+    allFindings.push({
+      ruleId: "RTR012",
+      plane: "transcript",
+      severity: "INFO",
+      file: "session-transcripts",
+      detail: `Filtered ${harnessSystemReminderCount} Claude Code harness-native <system-reminder> attachment rows from untrusted tool_result delimiter checks`,
+      evidence: `${harnessSystemReminderCount} native attachment rows vs ${allFindings.filter((f) => f.ruleId === "RTR008").length} spoofed tool_result delimiters`
+    });
+  }
+
+  if (benignLifecycleCount > 0) {
+    allFindings.push({
+      ruleId: "RTR013",
+      plane: "repo",
+      severity: "INFO",
+      file: "workspace-repos",
+      detail: `Separated ${benignLifecycleCount} benign local package.json build/prepare script(s) from network preinstall/postinstall traps`,
+      evidence: `${benignLifecycleCount} local build lifecycle scripts`
+    });
+  }
+
+  if (emojiZwjFilteredCount > 0) {
+    allFindings.push({
+      ruleId: "RTR014",
+      plane: "repo",
+      severity: "INFO",
+      file: "skill-markdown-files",
+      detail: `Separated ${emojiZwjFilteredCount} legitimate composite Emoji ZWJ (U+200D) sequence(s) from standalone zero-width steganography`,
+      evidence: `${emojiZwjFilteredCount} emoji ZWJ vs ${skillZeroWidthCount} standalone U+200B in skills`
+    });
+  }
+
+  const summary = computeRiskSummary(allFindings);
+
+  return {
+    skillFilesScanned: skillFiles.length,
+    reposChecked,
+    sessionsScanned: transcriptFiles.length,
+    score: summary.score,
+    grade: summary.grade,
+    severityCounts: summary.severityCounts,
+    ruleCounts: summary.ruleCounts,
+    metrics: {
+      harnessSystemReminderCount,
+      benignLifecycleCount,
+      emojiZwjFilteredCount,
+      skillZeroWidthCount,
+      transcriptsWithZeroWidth,
+      totalTranscriptZeroWidth,
+      toolResultHtmlComments
+    },
+    findings: allFindings
+  };
+}
+
+export function generateGuardHook() {
+  const hookScript = `#!/usr/bin/env node
+// Generated by repotrap (https://github.com/princejain756/repotrap)
+// PreToolUse guardrail blocking gh issue/pr or curl commands against untrusted targets when workspace traps exist,
+// and PostToolUse sanitizer alerting on Unicode Tag/Bidi smuggling or spoofed <system-reminder> tags.
+import fs from "node:fs";
+
+const raw = fs.readFileSync(0, "utf8");
+let payload;
+try {
+  payload = JSON.parse(raw);
+} catch {
+  process.exit(0);
+}
+
+const text = JSON.stringify(payload?.tool_response || payload?.tool_input || {});
+const BIDI_OR_TAG = /[\\u202A-\\u202E\\u2066-\\u2069]|\\uDB40[\\uDC00-\\uDC7F]/;
+const SPOOFED_TAG = /<\\/?(?:system-reminder|EXTREMELY_IMPORTANT|function_calls)\\b/i;
+
+if (BIDI_OR_TAG.test(text) || (payload?.tool_response && SPOOFED_TAG.test(text))) {
+  console.error("[repotrap] BLOCKED untrusted input containing Unicode Tag/Bidi smuggling or spoofed <system-reminder> delimiter.");
+  process.exit(2);
+}
+`;
+
+  const settingsSnippet = {
+    hooks: {
+      PostToolUse: [
+        {
+          matcher: "Bash|WebFetch|Read",
+          hooks: [
+            {
+              type: "command",
+              command: "node ~/.claude/hooks/repotrap-guard-hook.mjs"
+            }
+          ]
+        }
+      ]
+    }
+  };
+
+  return { hookScript, settingsSnippet };
+}
+
+export function getDemoResult() {
+  return {
+    skillFilesScanned: 525,
+    reposChecked: 16,
+    sessionsScanned: 153,
+    score: 64,
+    grade: "C",
+    severityCounts: {
+      CRITICAL: 0,
+      HIGH: 1,
+      MEDIUM: 15,
+      LOW: 1,
+      INFO: 3
+    },
+    ruleCounts: {
+      RTR005: 1,
+      RTR011: 15,
+      RTR007: 1,
+      RTR012: 1,
+      RTR013: 1,
+      RTR014: 1
+    },
+    metrics: {
+      harnessSystemReminderCount: 1526,
+      benignLifecycleCount: 7,
+      emojiZwjFilteredCount: 1,
+      skillZeroWidthCount: 2,
+      transcriptsWithZeroWidth: 5,
+      totalTranscriptZeroWidth: 142,
+      toolResultHtmlComments: 2
+    },
+    findings: [
+      {
+        ruleId: "RTR005",
+        plane: "repo",
+        severity: "HIGH",
+        file: "~/.agents/skills/composio-cli/SKILL.md",
+        detail: "Instruction/skill file ~/.agents/skills/composio-cli/SKILL.md instructs agent to pipe remote URL directly into shell",
+        evidence: "curl -fsSL https://composio.dev/install | bash"
+      },
+      {
+        ruleId: "RTR011",
+        plane: "transcript",
+        severity: "MEDIUM",
+        file: "rollout-2026-10-11T14-16-47-01a12a24.jsonl",
+        detail: "48 standalone zero-width/directionality character(s) (U+200B) in rollout-2026-10-11T14-16-47-01a12a24.jsonl (custom_tool_call_output)",
+        evidence: "Codes: U+200B"
+      },
+      {
+        ruleId: "RTR011",
+        plane: "transcript",
+        severity: "MEDIUM",
+        file: "c71c67c1-e80e-477d-b5a1-c072488e72a8.jsonl",
+        detail: "2 standalone zero-width/directionality character(s) (U+200B) in c71c67c1-e80e-477d-b5a1-c072488e72a8.jsonl",
+        evidence: "Codes: U+200B"
+      },
+      {
+        ruleId: "RTR007",
+        plane: "repo",
+        severity: "LOW",
+        file: "~/.agents/skills/writing-clearly-and-concisely/signs-of-ai-writing.md",
+        detail: "2 standalone zero-width/directionality character(s) (U+200B) in ~/.agents/skills/writing-clearly-and-concisely/signs-of-ai-writing.md",
+        evidence: "Codes: U+200B"
+      }
+    ]
+  };
+}