secure-skill-content-sanitization

Sanitizing markdown and HTML against prompt injection involves detecting and neutralizing visually hidden content like CSS-hidden text, HTML comments, and malicious links before it enters an agent's context. This process strips HTML, extracts comments, and normalizes Unicode to eliminate hidden instruction channels.

Hidden text in markdown uses CSS-hidden elements, HTML comments, or zero-width and bidi characters to silently influence AI agents. This obfuscated content acts as a hidden instruction channel, bypassing human review to inject malicious or misleading directives directly into agent context.

Detecting zero-width characters and homoglyphs in repository files requires normalizing Unicode and scanning for obfuscation techniques across markdown, HTML, SVG, and text files. The scan flags these invisible characters with severity levels to prevent misleading or malicious content from entering agent context.

Yes, you can scan SVG and HTML files to flag image-based exfiltration and javascript or data links. The sanitization process identifies these attack vectors alongside CSS-hidden elements and bidi overrides, categorizing them with CRITICAL or HIGH severity levels in a standardized findings report.

Content sanitization works for CI pre-commit repository audits by scanning all markdown and HTML files to block or require review for any file containing invisible instructions or link-based exfiltration attempts. It produces a standardized sanitization report to enforce repository security.

The best way to extract and review HTML comments in markdown is to use a preprocessing sanitization step that strips HTML, expands collapsed content like <details> blocks, and extracts comments for manual review before the content enters an agent's context.