arcanum-sec/spikestripReversible HTML and JavaScript prompt decoys with opaque per-insertion keys.
[!WARNING]
This project is a work in progress.
SpikeStrip is intended to provide inspiration for people building defenses against AI automation tools such as ARTEX and similar systems. Its decoys and generation prompts are experimental.
SpikeStrip adds reversible prompt decoys to HTML source and JavaScript files. The comments include instructions that redirect an AI assessment, false vulnerability leads, and mathematical distractions. They may divert agents that follow source comments or turn unverified hints into scan targets. A conventional scanner would need to extract the hinted paths or parameters for these comments to affect its work. The tool does not reliably stop agents that isolate untrusted content or scanners that ignore comments.
Each insertion gets a random 12-character hex key, such as a7c94e2b610f. Keys are checked for duplicates within each run. Deployed comments have no SpikeStrip branding or fixed canary prefix. HTML comments appear in View Source; JavaScript comments are visible when someone fetches the script. The comments add no callbacks, executable loops, or runtime computation. Three built-in reference/pause decoys use neutral review wording.
The private manifest records each comment and its key. Use it to remove selected comments after line numbers change. The original ten-entry list remains in src/payloads.mjs as originalPayloads and contains exactly 100 words. The default pool now has 28 entries, including 18 additional instruction decoys and false vulnerability leads. The original mathematical tasks include open problems, contradictions, and endless tasks; not all of these are proven unsolvable.
The false leads name invented routes and parameters for SSRF, SQL injection, server-side template injection, DOM-based XSS, XXE, path traversal, and object authorization checks. Some comments claim that a retired path uses a product affected by Log4Shell (CVE-2021-44228), Spring Cloud Gateway CVE-2022-22947, or Apache HTTP Server CVE-2021-41773. The CVE identifiers are real; the paths and claimed deployments are fabricated. These comments create no routes, vulnerable handlers, or network requests. Review the proposed names against your application before deploying them, since an invented path could overlap a real route.
SpikeStrip is available under the MIT License, with copyright held by Arcanum. You may use, modify, distribute, and sell copies, including in commercial products, provided that you retain the copyright and permission notices in copies or substantial portions of the software. The license does not require public promotional credit for every commercial use.
SpikeStrip requires Node.js 20 or newer. Run these commands from this repository.
npm install --ignore-scripts
node bin/spikestrip.mjs --help
Alternatively, use pnpm install --frozen-lockfile --ignore-scripts with the checked-in lockfile. The package is private and is not intended for publication to npm.
Run the tool against the built static web root, after minification and before deployment. Source and output must be separate directories, with neither inside the other. The output copy includes ordinary assets and modified files. The tool leaves originals untouched and excludes symlinks, VCS metadata, dependency directories, private manifest folders, and environment files.
# This preview validates inputs and writes nothing.
node bin/spikestrip.mjs inject ./site --output ./site-planted --count 20 --manifest ./private/run.json
# Apply the plan to a new copy.
node bin/spikestrip.mjs inject ./site --output ./site-planted --count 20 --manifest ./private/run.json --write
--count is the total number of insertions across the tree. Placement, payload selection, and keys use OS randomness. Previews and subsequent writes may choose different positions and keys. Every insertion receives its own key even when built-in text repeats. If no manifest path is supplied, one is created in .spikestrip/ beside the output directory. Keep that folder private and outside the deployed site.
The tool supports .html, .htm, .js, .mjs, and .cjs files. It uses Acorn statement boundaries to place JavaScript comments, then checks that the syntax tree is equivalent. HTML comments go before direct children of explicit head or body elements. A document-tree check rejects changes beyond comments.
The tool does not insert into attribute strings, raw text, templates, inline script bodies, or text content. It skips and reports fragments without explicit head/body, invalid JavaScript, unsupported JSX/TypeScript files, and source files over 2 MB. It also reports supported source files that have no safe insertion positions. These source files are copied unchanged.
Use --raw if you want a text file of comments to sprinkle into your web source yourself. This option needs no site directory and does not insert anything into your files or copy a build tree. It provides an alternative when you do not want an insertion tool in your build pipeline.
# Preview an export without creating a file.
node bin/spikestrip.mjs inject --raw --output ./comments.txt --count 30
# Export JavaScript/CSS block comments, with one comment per line.
node bin/spikestrip.mjs inject --raw --output ./comments.txt --format js --count 30 --write
# Export HTML/SVG comments instead.
node bin/spikestrip.mjs inject --raw --output ./html-comments.txt --format html --count 30 --write
Each exported comment has its own random 12-character key. The default format is js; --format html changes the wrapper. Choose one format per export, and place comments only where that file type permits comments. Existing output files are never overwritten. Raw exports accept counts from 1 to 10,000 for built-ins and from 1 to 1,000 with --dynamic.
Raw exports create no removal manifest because SpikeStrip does not know where you paste the comments. Keep the text file as your key inventory, and search for those keys to remove the comments manually. The remove command handles automatic insertions recorded in a manifest; it cannot discover manual placements from a raw text file. Do not pass a source directory or --manifest with --raw.
The same generation flags work with raw exports. For example, after setting OPENAI_API_KEY, run node bin/spikestrip.mjs inject --raw --output ./unique-comments.txt --format js --dynamic --provider openai --model YOUR_MODEL_ID --count 40 --write. A preview still makes no API request.
Add --mode artex to select 16 decoys designed around the public ARTEX forks studied in the research notes. The profile includes quoted API paths, fabricated archive chunks, route-map entries, worker-to-planner handoffs, traffic-review detours, and keyed summary references. The default --mode generic keeps the original mixed pool.
# Inject the ARTEX profile into a separate site copy.
node bin/spikestrip.mjs inject ./site --output ./site-artex --mode artex --count 20 --manifest ./private/artex.json --write
# Export the ARTEX profile for manual placement.
node bin/spikestrip.mjs inject --raw --output ./artex-comments.txt --mode artex --format js --count 30 --write
# Generate new profile-specific comments with your provider key.
node bin/spikestrip.mjs inject --raw --output ./artex-unique.txt --mode artex --dynamic --provider anthropic --model YOUR_MODEL_ID --count 40 --write