bogus "AntiSamy" warning breaks clientlibs

My clientlibs are getting corrupted, replaced by "./bad_files/clientlib-base.css"

I am seeing this strange warning in my error.log:

This happens in a component that uses data-sly-resource to re-use content from another page.

What could be causing this? I searched everywhere and I have no "position" style attribute anywhere!