T08 · Insecure Dependencies
Warning
- Location
references/15-architecture-improvement.md:41- Finding
Generated architecture reports load mutable executable resources from unpinned CDNs
- Content
View full analysis
/architecture-review-.html Use Tailwind through a CDN for layout and styling. Use Mermaid through a CDN when diagrams are required. ``` ### Technical Analysis The workflow directs the agent to create an HTML report that imports Tailwind and, when needed, Mermaid from third-party content delivery networks. It does not prescribe: - An approved CDN hostname. - An immutable dependency version. - A cryptographic Subresource Integrity hash. - A restrictive Content Security Policy. - Local vendoring or verification of the downloaded resources. Mermaid is normally delivered as browser-executed JavaScript. Consequently, the effective code executed when the report is opened can change after the Skill package has been reviewed. A compromised CDN account, mutable resource, upstream release, or network delivery path could cause arbitrary JavaScript to execute in the report's browser origin. This is a supply-chain weakness rather than evidence that the current Skill intentionally supplies malicious code. ### Attack Path 1. A user requests an architecture review. 2. The agent follows the workflow and generates an HTML report in the temporary directory. 3. The generated report references mutable Tailwind or Mermaid resources hosted on a CDN. 4. The user opens the report in a browser. 5. The browser contacts the external CDN and downloads the referenced resources. 6. If the resource or its delivery ...[truncated 886 chars]- Remediation
View remediation