Repolode
Submit
Arcanum-Sec

Arcanum-Sec/SpikeStrip

A Node.js CLI that plants reversible, keyed prompt-decoy comments in HTML and JavaScript to distract AI-driven security assessment agents.

View on GitHub
Stars
99
Forks
8
Open issues
0
Last commit
5 days ago

What is it?

SpikeStrip inserts decoy comments into built static web output such as HTML and JavaScript files. The comments contain instruction-style text, invented vulnerability leads with fabricated routes and parameters, and mathematical distractions, aimed at AI agents or scanners that read source comments and treat hints as scan targets. Each insertion gets a random 12-character hex key, and a private manifest records every comment so it can be removed later.

The tool works on a separate copy of the site, leaves originals untouched, and checks that JavaScript syntax trees and HTML document trees change only by comments. It can also export comments to a text file for manual placement, and an optional dynamic mode generates new decoy text through an OpenAI or Anthropic API key supplied from the environment. The project is marked as a work in progress and does not reliably stop agents that isolate untrusted content or scanners that ignore comments.

Key features

  • 01Inserts keyed decoy comments into HTML and JavaScript files while leaving originals unchanged.
  • 02Records every insertion in a private manifest that supports selective removal by key.
  • 03Verifies that JavaScript and HTML changes are limited to comments.
  • 04Exports comments as a text file for manual placement, with JS or HTML wrappers.
  • 05Offers an optional dynamic mode that generates new decoy text via OpenAI or Anthropic.

Use cases

  • Adding decoy hints to a built web app as one layer of defense against automated AI-driven assessment.
  • Generating a manual list of comments to place in CSS, SVG or other file types the CLI does not inject into.
  • Researching how AI assessment agents react to misleading source comments.

Quick start

  1. 1

    Install dependencies from the repository root

    npm install --ignore-scripts
  2. 2

    Check the CLI help to confirm it runs (requires Node.js 20 or newer)

    node bin/spikestrip.mjs --help
  3. 3

    Preview a built-in decoy injection into a separate site copy (writes nothing)

    node bin/spikestrip.mjs inject ./site --output ./site-planted --count 20 --manifest ./private/run.json

Things to know

  • The README describes the project as a work in progress and its decoys as experimental.
  • The tool does not reliably stop agents that isolate untrusted content or scanners that ignore comments.
  • Dynamic generation needs your own OpenAI or Anthropic API key and may incur provider costs.

In collections

CLI & terminal toolsSecurity scanners, audits & threat intel tools

Topics

#security#ai-security#honeypot#deception#web-security#nodejs#cli#html

FAQ

What is SpikeStrip?
A Node.js CLI that plants reversible, keyed prompt-decoy comments in HTML and JavaScript to distract AI-driven security assessment agents. SpikeStrip inserts decoy comments into built static web output such as HTML and JavaScript files. The comments contain instruction-style text, invented vulnerability leads with fabricated routes and parameters, and mathematical distractions, aimed at AI agents or scanners that read source comments and treat hints as scan targets. Each insertion gets a random 12-character hex key, and a private manifest records every comment so it can be removed later.
Is SpikeStrip free to use? What license does it have?
SpikeStrip is open source under the MIT license. Check the license terms before using it in commercial products.
Is SpikeStrip still maintained?
Actively maintained. The last commit to SpikeStrip was on Nov 2, 2026.
What can I use SpikeStrip for?
Adding decoy hints to a built web app as one layer of defense against automated AI-driven assessment. Generating a manual list of comments to place in CSS, SVG or other file types the CLI does not inject into. Researching how AI assessment agents react to misleading source comments.
How do I install SpikeStrip?
Install dependencies from the repository root: npm install --ignore-scripts Check the CLI help to confirm it runs (requires Node.js 20 or newer): node bin/spikestrip.mjs --help Preview a built-in decoy injection into a separate site copy (writes nothing): node bin/spikestrip.mjs inject ./site --output ./site-planted --count 20 --manifest ./private/run.json
Where can I get SpikeStrip?
The source code and installation instructions are on GitHub: https://github.com/Arcanum-Sec/SpikeStrip

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects