T09 · Insecure Skill Coding Practices
- Location
scripts/run.py:47- Finding
Unescaped Markdown and HTML Injection in Generated Reports
- Content
View full analysis
Vulnerability Details
File Location:
scripts/run.py, lines 47–55
Vulnerability Type: Untrusted content injection into Markdown output
Risk Level: MediumVulnerable Code
python bullets = [line.strip("- ").strip() for line in input_text.splitlines() if line.strip()] bullets = bullets[:18] out = [f"# {title} 结果", "", f"> 模式：{spec['mode']}", f"> 摘要：{summary}", ""] for idx, section in enumerate(sections): out.append(f"## {section}") if bullets: selected = bullets[idx::max(1, len(sections))][:3] for item in selected: out.append(f"- {item}")Technical Analysis
The report generator treats each non-empty input line as a bullet and inserts it directly into Markdown output without escaping Markdown metacharacters or removing raw HTML.
An attacker able to influence a handover input document can supply active Markdown or HTML, for example:
markdown <img src="https://attacker.example/track">or:
markdown These payloads remain active in the generated report. If the report is opened in a Markdown renderer that permits raw HTML or automatically retrieves remote images, the renderer may contact an attacker-controlled server.
The function also does not distinguish ordinary handover information from structural Markdown. Consequently, crafted headings, links, images, and HTML can alter the generated report's presentation or introduce deceptive content. Exploitability and final behavior depend on the Markdown viewer's security policy.
Attack Path
- An attacker prepares or modifies a handover input file.
- The attacker places crafted Markdown or HTML in one of its non-empty lines.
- A user processes the file with
scripts/run.py. make_structured_report()copies the crafted line directly into the generated report.- The user or another recipient opens the report in an active Markdown or HTML renderer.
- The injected content changes th ...[truncated 686 chars]
- Remediation
View remediation
Remediation Suggestions
- Escape Markdown control characters in all untrusted input before interpolation, including backslashes, backticks, asterisks, underscores, braces, brackets, parentheses, angle brackets, hash signs, plus signs, hyphens, exclamation marks, and pipe characters.
- Strip or encode raw HTML tags rather than passing them through to the report.
- Consider treating input as plain text and emitting it inside fenced code blocks or another inert representation where appropriate.
- If links are required, parse and validate them explicitly. Permit only approved schemes and consider blocking remote images by default.
- Add output-sanitization tests covering:
- Raw HTML tags.
- Markdown images and links.
- Injected headings and block quotes.
- Nested or malformed Markdown.
javascript:,data:, and remote-resource URLs.
- Document that generated reports should be opened with remote-content loading disabled unless the output has been sanitized.
- Apply equivalent sanitization to every report-building function that may later interpolate untrusted file contents.