Hidden Payload in HTML Comment
Attackers hide commands inside HTML comment markers (<!-- ... -->) in SKILL.md files used by AI agents. Humans reading the file in a rendered view won't see the comment, but the agent's parser reads it as text and can follow the instructions.
How the attack works
An attacker adds a SKILL.md file, or modifies an existing one, containing an HTML comment block. Inside that comment they place text like requests to output API keys, override the agent's prior instructions, or contact a command-and-control URL. Because HTML comments are invisible when rendered normally, a human reviewer skimming the file sees nothing suspicious. The agent, however, ingests the raw file content including the comment and can treat the hidden text as an instruction to follow. This has been observed in a campaign named ClawHavoc, where hidden comments told the agent to output all API keys.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 3ba0bb20-0ded-4abe-a911-fd1571042ccc
- Severity
- Critical
Why it matters
An organization can have its AI agent silently exfiltrate secrets such as API keys, or execute attacker-chosen actions, triggered by a skill file that looks clean on visual inspection.
What you can do
- →Review SKILL.md and other agent-loaded files for HTML comment blocks (<!-- ... -->) before trusting them, not just the rendered output.
- →Treat any comment content that resembles a command, URL, or instruction (e.g. 'output', 'send', 'curl', 'fetch') as suspicious even if it looks like documentation.
- →Strip or ignore HTML comments when parsing skill/instruction files so hidden text cannot reach the agent's context.
- →Require code review and diffing of skill files from external or third-party sources before deployment, since legitimate tutorials may also use comments containing curl/wget examples.
Known benign look-alikes
- A web development tutorial SKILL.md that includes HTML comment examples discussing how to use curl or wget commands in documentation snippets, e.g. '<!-- Example: curl https://api.example.com/v1/status to check health -->' could trigger pattern 1 despite being legitimate educational content.