T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:64
- Finding
- Unpinned Remote JavaScript Dependencies in Generated HTML## Vulnerability Details **File Location**: `SKILL.md`, lines 64-66 **Vulnerability Type**: Unpinned executable third-party CDN dependencies **Risk Level**: Medium ### Vulnerable Code Snippet The relevant instruction, translated into English, is: ```text 1. Generate a complete HTML file and write it to the workspace directory. 2. Import CDN libraries: use the 3Dmol.org CDN for 3Dmol.js, cdnjs.cloudflare.com for JSXGraph, and cdn.jsdelivr.net for Three.js. 3. Use a Chinese interface for titles, labels, buttons, and prompts. ``` ### Technical Analysis The skill instructs the agent to place executable JavaScript from external CDNs into generated HTML pages. It does not require exact dependency versions, immutable URLs, cryptographic hashes, Subresource Integrity attributes, or a restrictive Content Security Policy. Consequently, the generated artifact may trust mutable third-party resources whose contents can change after the skill itself has been reviewed. If a CDN account, upstream release, DNS path, or distribution endpoint is compromised, a browser opening the generated page will execute the substituted JavaScript. Although later documentation recommends preferring local Canvas2D implementations, it does not remove or securely constrain this explicit CDN-import requirement. There is no evidence that the named CDNs currently serve malicious content; the vulnerability is the absence of supply-chain integrity controls. ### Attack Path 1. A user requests a chemistry visualization that uses 3Dmol.js, JSXGraph, or Three.js. 2. Following `SKILL.md`, the agent generates an HTML file containing a remote CDN script reference. 3. The dependency URL is unpinned or otherwise lacks cryptographic integrity verification. 4. An attacker compromises or gains influence over the selected upstream resource, CDN distribution path, or mutable release. 5. The user opens the generated page through the prescribed preview workflow. ...[truncated 728 chars]
- Remediation
- ## Remediation Suggestions 1. Prefer audited dependencies stored locally with the skill or replace them with the documented zero-dependency Canvas2D implementation. 2. If remote dependencies are necessary, pin every library to an exact, immutable version and avoid aliases such as `latest`. 3. Add Subresource Integrity hashes to every external script and stylesheet: ```html <script src="https://trusted.example/library-X.Y.Z.min.js" integrity="sha384-EXPECTED_HASH" crossorigin="anonymous"></script> ``` 4. Apply a restrictive Content Security Policy that permits scripts only from explicitly approved origins and disallows unsafe inline execution where feasible. 5. Maintain an allowlist of approved CDN hosts, exact resource paths, versions, and expected hashes. 6. Extend `scripts/verify_output.sh` to reject unversioned remote resources, missing SRI attributes, unapproved hosts, and mutable dependency URLs. 7. Vendor and periodically audit dependencies when offline or `file://` compatibility is required.