Fix P2 HTML comment boundary matching

[Patrick-Erichsen]

User-visible bug

SkillSpector could start a P2 "hidden instructions" match in one HTML comment, include ordinary visible documentation after that comment had already closed, and stop at a later comment. The resulting finding falsely presented visible text as hidden prompt injection and could change an otherwise safe scan verdict.

What this changes

• keep each P2 match inside one actual HTML comment and recognize both --> and browser-compatible --!> closers
• match injection keywords at separator, snake_case, camelCase, PascalCase, and acronym-to-PascalCase boundaries
• continue rejecting keyword prefixes in ordinary words such as target, SYSTEMATIC, POSTGRES, and GETTING
• add direct pattern tests plus graph-level tests proving false positives stay SAFE and real hidden instructions cannot receive a SAFE verdict

Reviewer follow-up

• camel/Pascal identifiers such as ignorePreviousInstructions, pleaseIgnorePreviousInstructions, POSTRequestToServer, and SYSTEMPrompt are covered
• --!> terminates the comment, so following visible text cannot be consumed by the hidden-instruction match

Fixes #297.

Validation

• uv run pytest -m 'not integration and not provider' tests/ (3,174 passed, 14 skipped, 38 deselected, 4 xfailed)
• uv run pytest tests/nodes/analyzers/test_static_patterns.py tests/nodes/test_security_remediation.py -q (237 passed)
• uv run ruff check src/ tests/
• uv run ruff format --check src/ tests/
• rescanned ClawHub release-validation@0.1.3; P2 findings dropped from 2 to 0
• autoreview: clean, no accepted/actionable findings

[rng1995]

[SkillSpector Review]

Re-reviewed at 1e82b2b after the current-main merge. The patch fixes the reported ordinary-substring and standard cross-comment false positives, and all 154 focused static-pattern tests pass, but two boundary cases still block approval. The alphanumeric boundary drops common camel/Pascal-style hidden directives, producing an end-to-end SAFE, complete verdict, and the tempered body does not recognize --!> as an HTML comment closer, so it can still span from a comment into visible text. Please preserve case-transition directive detection, honor browser-compatible comment endings, and add direct plus end-to-end regressions.

[Patrick-Erichsen]

@rng1995 Thanks for the review. Both requested changes are addressed in 248a5b0, the two threads are resolved with implementation details, and the PR description now leads with the user-visible failure mode. The final full suite and autoreview are clean; this is ready for re-review.

[rng1995]

[P2] Handle abrupt empty-comment endings before scanning visible text. The HTML tokenizer emits an empty comment and returns to data state when the first character after <!-- is >, or when it is -> (the comment-start and comment-start-dash states). This matcher recognizes only --> and --!>, so both <!--> visible system docs <!-- safe --> and <!---> visible system docs <!-- safe --> are still returned as one P2 match on this head. Treat these opener-adjacent endings as boundaries and add direct plus graph negative regressions so the original cross-boundary false-positive class is fully closed.

[rng1995]

[SkillSpector Review]

Re-review: the requested camel/Pascal/acronym boundaries and --!> termination are fixed, both prior threads are resolved, all checks pass, and the current-main merge validates cleanly. One HTML-tokenizer edge still leaves the original cross-boundary false-positive class open: abrupt empty comments <!--> and <!---> return to data state, but P2 scans through their following visible text until a later -->. Please treat those two forms as comment boundaries and add direct plus end-to-end regressions.