T03 · Remote Payload Retrieval and Execution
- Location
SKILL.md:90- Finding
Mutable Third-Party Code Loaded into Generated Health Reports
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 90-92
Vulnerability Type: Unpinned remote JavaScript and CSS retrieval
Risk Level: MediumVulnerable Code:
markdown **HTML technical requirements**: - Pure static HTML, use CDN to include Chart.js v4 and necessary CSS libraries - Use CSS Grid/Flexbox layout, responsively adapting to desktop and mobileTechnical Analysis
The Skill explicitly instructs the agent to include Chart.js and unspecified CSS libraries from a CDN in generated HTML health reports. It does not define an approved CDN, pin an exact dependency version, require Subresource Integrity hashes, or constrain which CSS libraries may be loaded.
Consequently, the effective JavaScript executed by a generated report can change after the Skill package has been audited. A compromised CDN, malicious dependency version, DNS or hosting compromise, or unsafe CDN URL selected during report generation could introduce attacker-controlled code into the browser.
The phrase “necessary CSS libraries” is additionally unconstrained. Depending on how the instruction is implemented, generated reports could reference arbitrary third-party resources. Although CSS alone has more limited execution capabilities than JavaScript, unnecessary remote resources still create privacy and supply-chain exposure.
Attack Path
- A user provides sensitive medical indicators or an image of a health report.
- The Skill generates an HTML report containing the extracted health information.
- Following
SKILL.md, the generated document references Chart.js or another dependency on a third-party CDN. - The CDN resource is compromised, substituted, or resolved to an unsafe dependency because neither its exact artifact nor its integrity hash is fixed.
- The user opens the generated report in a browser.
- The browser retrieves and executes the attacker-controlled JavaScript in the report's origin and DOM con ...[truncated 1013 chars]
- Remediation
View remediation
Remediation Suggestions
- Bundle a reviewed, exact version of Chart.js locally with the generated report instead of retrieving executable code at viewing time.
- If remote hosting is unavoidable:
- Allowlist one trusted HTTPS CDN.
- Pin the complete dependency version rather than using a major-version alias such as
v4. - Pin the exact minified artifact path.
- Add a verified Subresource Integrity hash.
- Add the appropriate
crossorigin="anonymous"attribute.
- Remove the open-ended authorization to include “necessary CSS libraries.” Prefer self-contained CSS embedded in the generated HTML.
- Apply a restrictive Content Security Policy, for example by limiting
script-src,style-src,connect-src,img-src, andfont-srcto only required origins. - Set
connect-src 'none'when charts do not require network access, reducing the ability of injected code to exfiltrate report data. - Avoid inline event handlers and dynamically evaluated code so that a strict policy can omit both
unsafe-inlineandunsafe-eval. - Document and review every externally loaded artifact as part of the Skill's dependency inventory.