# token-smuggling

> Claude/Codex skill by [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars · Updated 2026-07-31

Detects user input passed to LLMs without Unicode normalization, allowing RTL overrides, zero-width joiners, and homoglyph attacks. Use when writing code that passes user-supplied strings to an LLM, constructs prompts from external data, or processes text that may contain Unicode control characters, homoglyphs, or invisible formatting characters.

Tags: llms, security, skills

## Install

```sh
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/token-smuggling ~/.claude/skills/token-smuggling
```

## From README

Token Smuggling / Unicode Injection (LLM01:2025) What this checks Detects user input passed to LLMs without Unicode normalization. Attackers embed RTL override characters, zero-width joiners, or homoglyphs to manipulate prompt structure, bypass keyword filters, or make malicious instructions appear legitimate. Vulnerable patterns User input interpolated into a prompt with no normalization step at the trust boundary Blocklists or keyword filters that compare against pre-normalized text, letting homoglyph variants pass Retrieved RAG content or tool outputs concatenated into a prompt on a path the sanitizer does not cover Comparisons on raw bytes where bidirectional overrides or zero-width characters can split or hide tokens Fix immediately Flag the vulnerable code, explain the risk, and suggest a fix establishing these properties.

## Links

- HTML page: https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/token-smuggling/
- GitHub: https://github.com/thejefflarson/soundcheck
- Author: [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md)

## More from this repo

- [authentication-failures](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/authentication-failures/index.md) — Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [broken-access-control](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/broken-access-control/index.md) — Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [concurrency-correctness](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/concurrency-correctness/index.md) — Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars