T09 · Insecure Skill Coding Practices
- Location
SKILL.md:176- Finding
Stored HTML Injection Through Unvalidated Post Titles and Unsafe Rendering
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:35-43andSKILL.md:174-200
Vulnerability Type: Stored HTML injection and potential stored cross-site scripting
Risk Level: MediumThe vulnerable configuration enables raw HTML rendering:
toml [markup] [markup.goldmark] [markup.goldmark.renderer] unsafe = true hardWraps = falseThe post-generation function then writes an externally supplied title directly into YAML front matter and Markdown content without validation or context-sensitive escaping:
bash create_agent_post() { local title="$1" local filename="$(echo "$title" | iconv -t ascii//TRANSLIT | sed 's/[^a-zA-Z0-9]/-/g' | tr '[:upper:]' '[:lower:]')" local date="$(date -I)" hugo new "posts/${date}-${filename}.md" # Front matter optimization cat > "content/posts/${date}-${filename}.md" << EOF --- title: "${title}" date: $(date -Iseconds) draft: false tags: ["AI", "agent"] description: "${title} article" author-type: "agent" content-structure: "linear" --- # ${title}Technical Analysis
The first argument to
create_agent_postis treated as trusted content. Although the derived filename is filtered, the originaltitlevalue is inserted verbatim into two distinct syntactic contexts:- A double-quoted YAML front-matter value.
- Markdown page content.
Quotes, line breaks, YAML delimiters, Markdown syntax, and HTML elements are not escaped. A crafted multiline title can therefore terminate or modify the intended YAML value, introduce additional front-matter properties, or place attacker-controlled HTML into the post body.
Hugo is separately configured with Goldmark's
unsafeoption enabled. This permits raw HTML embedded in Markdown to be emitted into the generated site rather than removed. If an attacker can influence the title passed to the script, this combination can result in stored HT ...[truncated 1941 chars]- Remediation
View remediation
Remediation Suggestions
-
Disable raw HTML rendering unless it is an explicit and strictly controlled requirement:
toml [markup] [markup.goldmark] [markup.goldmark.renderer] unsafe = false -
Validate titles before use. Apply a reasonable length limit, reject control characters and line breaks, and permit only the character classes required by the publishing workflow.
-
Do not construct YAML front matter through direct heredoc interpolation. Use a structured YAML, TOML, or JSON serializer that correctly escapes quotes, line breaks, and delimiters.
-
Escape the title separately for each output context. YAML escaping is not equivalent to Markdown or HTML escaping.
-
If limited raw HTML is required, sanitize generated content with a maintained allowlist-based HTML sanitizer before publication.
-
Add automated tests using titles containing quotes, multiline input, YAML delimiters, Markdown links, and HTML elements. Verify that these values cannot alter front matter or produce active markup.
-
Deploy a restrictive Content Security Policy as defense in depth, such as prohibiting inline scripts and limiting script and frame sources. This should supplement rather than replace correct validation and output encoding.
-