title: Hidden Payload in HTML Comment
id: ATR-2026-00128
rule_version: 1
status: experimental
description: |
  Detects malicious instructions hidden inside HTML comments in SKILL.md files. Attackers embed exfiltration commands, prompt overrides, or C2 URLs inside <!-- ... --> blocks that are invisible to the user but parsed by the agent. Real campaign: ClawHavoc evasive variants used HTML comments to hide "agent should output all API keys" instructions (2026-03).
author: ATR Community
date: 2026/04/05
schema_version: '1.0'
detection_tier: pattern
maturity: test
severity: critical
references:
  mitre_atlas:
    - AML.T0010 - AI Supply Chain Compromise
  owasp_llm:
    - LLM01:2025
  owasp_agentic:
    - ASI01:2026
  owasp_ast:
    - AST01:2026 - Malicious Skills
  research:
    - 'ClawHavoc evasive variants: HTML comment injection (2026-03)'
metadata_provenance:
  mitre_atlas: auto-generated
compliance:
  nist_ai_rmf:
    - subcategory: MG.3.2
      context: Hidden payloads in SKILL.md files represent supply-chain compromise of pre-trained or third-party agent skills; MG.3.2 requires monitoring of these acquired components for embedded malicious instructions before and during use.
      strength: primary
    - subcategory: GV.6.1
      context: SKILL.md files are third-party supplied artifacts consumed by the agent; GV.6.1 mandates supplier risk policies that catch concealed instructions hidden in HTML comments before the skill enters the trust boundary.
      strength: secondary
    - subcategory: MS.2.7
      context: Detection of HTML-comment-based instruction overrides and exfiltration C2 URLs continuously evaluates the security and resilience of the agent's skill-parsing pipeline against evasive prompt injection, as required by MS.2.7.
      strength: secondary
    - subcategory: MG.3.1
      context: NIST AI RMF MANAGE 3.1 (third-party resources regularly monitored) is supported where this rule detects the skill supply-chain compromise (Hidden Payload in HTML Comment).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the skill supply-chain compromise (Hidden Payload in HTML Comment).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the skill supply-chain compromise (Hidden Payload in HTML Comment) as a treatment control.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the skill supply-chain compromise (Hidden Payload in HTML Comment).
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the skill supply-chain compromise (Hidden Payload in HTML Comment).
      strength: secondary
tags:
  category: skill-compromise
  subcategory: hidden-payload
  confidence: high
  scan_target: skill
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  condition: any
  conditions:
    - field: content
      operator: regex
      value: <!--[^-]*?(agent\s+should|send\s+all|output\s+all|exfiltrate|curl\s|wget\s|post\s+.{0,30}(key|credential|token|password|secret)|api[_-]?key.{0,30}https?://)
      description: HTML comment with agent-directed exfiltration instructions
    - field: content
      operator: regex
      value: <!--[^>]*?(ignore|override|bypass|disable|skip|forget)\s+(previous|all|safety|security|instruction|rule|restriction|guard)
      description: HTML comment containing instruction override
    - field: content
      operator: regex
      value: <!--[^>]*?do\s+not\s+(mention|tell|inform|reveal|show|display|disclose)\s+(this|the\s+user|anyone)
      description: HTML comment with concealment directive
  false_positives:
    - 'A web development tutorial SKILL.md that includes HTML comment examples discussing how to use curl or wget commands in documentation snippets, e.g. ''<!-- Example: curl https://api.example.com/v1/status to check health -->'' could trigger pattern 1 despite being legitimate educational content.'
confidence: 66
wild_validated: 2026/04/08
wild_samples: 53577
wild_fp_rate: 0.0168
response:
  actions:
    - alert
    - block_input