T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:127
- Finding
- Stored HTML Injection in Generated Research Report<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 127–521 **Vulnerability Type**: Unescaped insertion of untrusted data into HTML **Risk Level**: Medium ### Vulnerable Code ```html <h1>[Keyword] Opportunity Report</h1> ``` ```html <td>[Product title truncated to 60 chars]</td> ``` ```html <td>[Company Name]</td> ``` ```html <td>[keyword]</td> ``` The template is followed by this instruction: ```text Fill ALL placeholder values (`[...]`) with real data from the research phases. Save the complete file to the path from Step 1. ``` ### Technical Analysis The skill instructs the agent to insert user-provided values and data returned by external MCP research tools directly into a standalone HTML document. It does not require HTML escaping, sanitization, strict type validation, or safe DOM construction. Dynamic values include product keywords, product titles, supplier names, trademark records, campaign recommendations, and other externally sourced fields. If any value contains HTML markup or executable event handlers, direct placeholder replacement can transform that value into active document content. For example, an upstream field containing an image element with an error handler could execute JavaScript when the generated report is opened. Script tags are not the only relevant vector; event handlers, embedded frames, SVG content, form elements, and navigation markup may also produce active behavior. The template does not define a Content Security Policy to mitigate successful injection. This is a stored HTML injection issue because the attacker-controlled value is written into the generated report and activated later when a user opens that file. ### Attack Path 1. An attacker places crafted HTML in data that can be returned by a product, supplier, trademark, or keyword research source. Alternatively, a user supplies a malicious product keyword. 2. One of the declared LaunchFast MCP tools returns the crafted value as ordinary resea ...[truncated 1379 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require HTML-context escaping for every dynamic value before interpolation. At minimum, encode: - `&` as `&` - `<` as `<` - `>` as `>` - `"` as `"` - `'` as `'` 2. Treat all user input and MCP-returned fields as untrusted, including product titles, supplier names, trademarks, keywords, recommendations, URLs, and free-form descriptions. 3. Apply strict type and allowlist validation: - Parse prices, review counts, scores, quantities, and percentages as bounded numbers. - Restrict grades, verdicts, risk levels, and badge class suffixes to fixed enumerations. - Reject control characters and unexpected markup in textual fields. - Validate ASINs against the expected format. 4. Do not insert untrusted values into raw HTML attributes, CSS declarations, URLs, or class names. Where this is necessary, use context-specific encoding and allowlists rather than generic HTML escaping alone. 5. Prefer generating the document through a template engine with automatic escaping enabled. Do not use an unescaped/raw-output operator for research data. 6. Add a restrictive Content Security Policy to the generated document, for example: ```html <meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; img-src data:;"> ``` 7. Avoid links and other active content unless explicitly required. If links are included, allow only approved `https:` destinations and add `rel="noopener noreferrer"` when opening a new browsing context. 8. Add security tests using values that contain script tags, event-handler attributes, SVG payloads, quotes, angle brackets, and malicious URL schemes. Verify that each value appears only as inert text in the resulting report. ]]>