T09 · Insecure Skill Coding Practices
- Location
references/report-template-pro.html:6- Finding
Unescaped User-Controlled Content in Generated HTML Reports
- Content
View full analysis
Vulnerability Details
File Location:
references/report-template-pro.html:6, 100-101, 131, 150, 157, 174, 196-197; required generation behavior is defined inSKILL.md:158-162
Vulnerability Type: HTML injection and potential cross-site scripting
Risk Level: MediumVulnerable Code
html <title>模糊需求接招包 · __requirement_title__</title> <h1 class="hero-title">__requirement_title__</h1> <p class="hero-desc">__one_line_summary__</p> <div class="finding">__verbatim__</div> <tbody>__question_rows__</tbody> __layer_sections__ <pre class="flow">__main_flow__</pre> <div class="finding"> <div class="dim">30 秒版</div> __reply_short__ </div> <div class="finding"> <div class="dim">稍正式版</div> __reply_formal__ </div>The associated instructions require use of this template and verbatim reproduction of the supplied requirement:
markdown HTML 输出必须使用本技能自己的 [references/report-template-pro.html](references/report-template-pro.html)。 - 原话复述，不改写原意Technical Analysis
The HTML report template places user-controlled or model-derived values directly into HTML text, title, table-body, and raw fragment contexts. Neither the template nor the Skill instructions require contextual HTML escaping, allowlist sanitization, or safe DOM construction.
The original requirement is explicitly required to be reproduced without changing its meaning. Consequently, markup embedded in a requirement can reach
__verbatim__. Derived fields such as__requirement_title__, question rows, layer sections, flow content, and response scripts may propagate the same attacker-controlled text into additional contexts.A payload such as:
html <img src=x onerror=alert(document.domain)>could become an active element when substituted into a raw body placeholder. A context-breaking payload can target the title element:
html </title><script>alert(document.domain)</script><title>The row and section placeholders are especially sensitive because the ...[truncated 1796 chars]
- Remediation
View remediation
Remediation Suggestions
-
Escape every scalar value according to its HTML context.
- At minimum, encode
&,<,>,", and'. - Apply escaping before inserting values such as the requirement title, summary, original wording, flow text, and response scripts.
- Do not rely on prompt instructions alone; use a deterministic encoder.
- At minimum, encode
-
Separate data placeholders from trusted structural templates.
- Do not generate
__question_rows__,__score_rows__,__risk_rows__, or__layer_sections__as arbitrary HTML strings. - Represent these sections as structured data and render them through a template engine with automatic escaping.
- Alternatively, construct elements with
document.createElement()and assign untrusted values throughtextContent.
- Do not generate
-
Sanitize any intentionally supported rich text.
- If formatting must be retained, use a strict allowlist sanitizer.
- Permit only necessary formatting elements and attributes.
- Remove scripts, event-handler attributes, unsafe URL schemes, embedded frames, SVG, MathML, style injection, and active form controls.
-
Protect special contexts.
- Never place untrusted content directly into
<title>. - Keep content intended for
<pre>elements text-only. - Validate and constrain any value used in a class or attribute context.
- Never place untrusted content directly into
-
Add defense-in-depth browser controls.
- Add a restrictive Content Security Policy that disallows inline scripts and event handlers, for example through an appropriate
Content-Security-Policyresponse header when hosted. - Avoid exposing privileged host bridges to generated reports.
- Consider opening standalone reports in an isolated or sandboxed origin.
- Add a restrictive Content Security Policy that disallows inline scripts and event handlers, for example through an appropriate
-
Document the safe rendering contract in
SKILL.md.- Explicitly require contextual escaping for all user-provided and model-generated content.
- State that “verbatim reproduction” refers to displayed text, not interpretation as HTML markup.
-
**Add securi ...[truncated 343 chars]
-