T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:176
- Finding
- Stored HTML Injection Through Unvalidated Post Titles and Unsafe Rendering## Vulnerability Details **File Location**: `SKILL.md:35-43` and `SKILL.md:174-200` **Vulnerability Type**: Stored HTML injection and potential stored cross-site scripting **Risk Level**: Medium The vulnerable configuration enables raw HTML rendering: ```toml [markup] [markup.goldmark] [markup.goldmark.renderer] unsafe = true hardWraps = false ``` The post-generation function then writes an externally supplied title directly into YAML front matter and Markdown content without validation or context-sensitive escaping: ```bash create_agent_post() { local title="$1" local filename="$(echo "$title" | iconv -t ascii//TRANSLIT | sed 's/[^a-zA-Z0-9]/-/g' | tr '[:upper:]' '[:lower:]')" local date="$(date -I)" hugo new "posts/${date}-${filename}.md" # Front matter optimization cat > "content/posts/${date}-${filename}.md" << EOF --- title: "${title}" date: $(date -Iseconds) draft: false tags: ["AI", "agent"] description: "${title} article" author-type: "agent" content-structure: "linear" --- # ${title} ``` ### Technical Analysis The first argument to `create_agent_post` is treated as trusted content. Although the derived filename is filtered, the original `title` value is inserted verbatim into two distinct syntactic contexts: 1. A double-quoted YAML front-matter value. 2. Markdown page content. Quotes, line breaks, YAML delimiters, Markdown syntax, and HTML elements are not escaped. A crafted multiline title can therefore terminate or modify the intended YAML value, introduce additional front-matter properties, or place attacker-controlled HTML into the post body. Hugo is separately configured with Goldmark's `unsafe` option enabled. This permits raw HTML embedded in Markdown to be emitted into the generated site rather than removed. If an attacker can influence the title passed to the script, this combination can result in stored HT ...[truncated 1941 chars]
- Remediation
- ## Remediation Suggestions 1. Disable raw HTML rendering unless it is an explicit and strictly controlled requirement: ```toml [markup] [markup.goldmark] [markup.goldmark.renderer] unsafe = false ``` 2. Validate titles before use. Apply a reasonable length limit, reject control characters and line breaks, and permit only the character classes required by the publishing workflow. 3. Do not construct YAML front matter through direct heredoc interpolation. Use a structured YAML, TOML, or JSON serializer that correctly escapes quotes, line breaks, and delimiters. 4. Escape the title separately for each output context. YAML escaping is not equivalent to Markdown or HTML escaping. 5. If limited raw HTML is required, sanitize generated content with a maintained allowlist-based HTML sanitizer before publication. 6. Add automated tests using titles containing quotes, multiline input, YAML delimiters, Markdown links, and HTML elements. Verify that these values cannot alter front matter or produce active markup. 7. Deploy a restrictive Content Security Policy as defense in depth, such as prohibiting inline scripts and limiting script and frame sources. This should supplement rather than replace correct validation and output encoding.