SG-043: Markdown Substructure Smuggling
Severity: HIGH
Directive-shaped content inside HTML comments, image alt/title, reference-link titles, footnote bodies, definition-list bodies, <details> blocks, or heading anchors.
Fires when
- An HTML comment (`<!-- ... -->`) carries instruction-shaped content (an action verb like run/exec/fetch/ignore).
- A markdown image alt/title, reference-link title, footnote body, or definition-list body carries a directive (action verb co-occurring with a sensitive token or URL).
- A `<details>` collapsible block hides directive content (action verb plus a sensitive token).
- A heading anchor id encodes directive content.
Remediation
No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.