sec-script-invisible

What it catches#

Invisible or bidirectional characters in a skill script.

Characters in a skill script that do not show up in an editor or a diff: bidirectional controls (U+202A to U+202E, U+2066 to U+2069), zero-width characters, Unicode tag characters and runs of variation selectors. Needs --include skills.

Why it matters#

Bidi controls make code read differently than it runs (Trojan Source); variation selectors and tag characters carry hidden payloads (Glassworm).

// scripts/check.js, shown as GitHub renders it
const isAdmin = false;
/* end admin check */ if (isAdmin) { console.log("hello"); }

// scripts/check.js
const isAdmin = false;
if (isAdmin) { console.log("hello"); }

How to fix#

Delete the characters. grep -nP '[\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2066}-\x{2069}\x{FE00}-\x{FE0F}\x{E0000}-\x{E007F}]' scripts/* shows where they are. If the script has to print such a character, write it as an escape ("‮") so it is visible.

Suppress or configure#

sec-script-invisible is a security rule, so it cannot be suppressed with a comment in the file: a suppression comment is itself a hidden comment, and an attacker who can add a payload can add one next to it. A comment that tries gets a suppression-not-allowed warning.

Turn it off, or change its severity, in .asitisrc.json, which shows up in review:

{ "rules": { "sec-script-invisible": "off" } }

Or accept the findings you have today in a baseline, so only new ones fail the build:

asitis lint --format json --write-baseline > .asitis-baseline.json
asitis lint --baseline .asitis-baseline.json

Source#

www.aikido.dev, read on 14 October 2026.