Chart Renderer Open

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:50 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent chart-report generator, but its generated HTML reports can execute injected browser code from report data.

Review this skill before installing if you may visualize untrusted, user-submitted, or shared data. It appears purpose-aligned, but generated reports should be treated as active HTML pages and not shared or opened with sensitive same-origin access until the template escapes data safely, uses HTML-safe JSON embedding, and pins or bundles dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: templates/chart_page.html:47

Finding

Stored client-side HTML and JavaScript injection in generated reports

Content

View full analysis

${sec.title}`; const uid=r.afterRender?('chart_'+Date.now()+'_'+Math.random().toString(36).slice(2,6)):null; h+=r.render(sec.data,uid); el.innerHTML+=h; if(r.afterRender&&uid) setTimeout(()=>r.afterRender(sec.data,uid),50); } ``` The text renderer directly interpolates the CSS class, title, and content: ```javascript registerRenderer('text', function(d){ const cls=d.level||'warning'; return `

${d.title||''}

${d.content||''}

`; }); ``` The table renderer directly interpolates headers and cells: ```javascript registerRenderer('table', function(d){ let h=''; (d.headers||[]).forEach(th=>h+=``); h+=''; (d.rows||[]).forEach(row=>{ h+=''; row.forEach(cell=>{ const cls=typeof cell==='string'&&cell.startsWith('↑')?' style="color:var(--green);font-weight:700"':typeof cell==='string'&&cell.startsWith('↓')?' style="color:var(--red);font-weight:700"':''; h+=`${cell}`; }); h+=''; }); h+='

${th}

'; return h; }); ``` The direction renderer directly interpolates recommendation fields: ```javascript let h='

'; (d.rows||[]).forEach((r,idx)=>{ const color=getColor(r.title,idx); const icon=get ...[truncated 6127 chars]

Remediation

View remediation

` - `` - Attribute-breaking quotes - Closing element tags - `javascript:` URLs ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: templates/chart_page.html:26

Finding

HTML parser breakout through JSON script elements and page-title replacement

Content

View full analysis

{{PAGE_TITLE}} ``` Serialized configuration and section data are embedded directly inside script elements: ```html ``` The page later parses their text content: ```javascript /* ===== DATA (JSON.parse from safe script tags) ===== */ const CFG=JSON.parse(document.getElementById('__cfg').textContent); const SECTIONS=JSON.parse(document.getElementById('__sections').textContent); ``` The assembly instructions specify ordinary JSON serialization but do not require HTML-safe script-element encoding: ```markdown ### Step 3: Assemble data Build the CFG and SECTIONS data structures per the `.md` format specs. **Data injection uses JSON.** The skeleton template loads data via `

Remediation

View remediation

/g, '\\u003e') .replace(/&/g, '\\u0026') .replace(/\u2028/g, '\\u2028') .replace(/\u2029/g, '\\u2029'); } ``` 2. Update `SKILL.md` to require this safe serializer rather than ordinary `JSON.stringify()` alone. 3. Prefer placing report data in a separate local JSON resource and loading it through a controlled mechanism when deployment constraints permit. 4. Do not place an untrusted title directly in the HTML template. Use a static initial title and assign the parsed title through the DOM API: ```javascript document.title = typeof CFG.title === 'string' ? CFG.title : 'Chart Report'; ``` 5. If server-side or build-time title insertion is retained, apply correct HTML text encoding before replacement. 6. Add regression tests for: - Literal and mixed-case `` sequences - `` sequences - HTML comments - `<`, `>`, and `&` - U+2028 and U+2029 - Strings combining closing tags with event-handler markup 7. Apply a restrictive Content Security Policy without `unsafe-inline` as defense in depth. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:54

Finding

Unpinned and integrity-unverified remote CDN dependencies

Content

View full analysis

{{PAGE_TITLE}} ``` ### Technical Analysis The Skill instructs the executing Agent to select and insert remote scripts for html2canvas, Chart.js, and the Chart.js data-label plugin. It does not specify: - Approved HTTPS origins - Exact immutable dependency versions - Subresource Integrity hashes - A dependency lock or checked-in local copy - A restrictive Content Security Policy - A validation process for the generated URLs Remote JavaScript executes with the same browser privileges as local report code. If the selected URL is mutable, mistyped, compromised, or controlled by an unsafe source, the effective code executed by the report can differ from the code reviewed in this project. This also conflicts with the claim that reports are self-contained because normal report operation may depend on runtime network access. ### Attack Path 1. During report assembly, the Agent selects CDN URLs for the required libraries. 2. The generated report contains exe ...[truncated 1083 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger keywords include very broad English phrases such as "chart," "visualize," and "generate report," which are likely to match many ordinary user requests outside the intended scope of this skill. Over-broad activation increases the chance that the skill is invoked unexpectedly, causing unprompted file generation or data rendering behavior in contexts where the user did not explicitly request this tool.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The Chinese trigger keywords are similarly broad, including generic terms like "生成图表" and "可视化," which can overlap with normal conversational requests for analysis or explanation. This broad matching expands the skill's activation surface across languages, increasing the risk of unintended invocation and side effects such as file creation or hosted content generation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs the agent to write generated HTML into both a project path and a hosted canvas directory, but it provides no requirement to inform the user or obtain confirmation before creating files. In a skill that can be triggered broadly, silent file creation and publication-like behavior materially increase the risk of unwanted artifact generation, data persistence, or accidental exposure of rendered content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The template declares lang="zh-CN", and the visible UI strings are also fixed in Chinese, which imposes a specific language/locale choice. Under the policy, locale-specific behavior should either be user-selectable or clearly documented as justified for a region-specific tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The natural-language comments and keyword mappings explicitly embed Chinese education-domain terms as "legacy compat," which introduces a language-specific behavior in an otherwise general-purpose renderer. There is no visible opt-in, locale selection, or justification that this renderer is intended to be Chinese- or region-specific only.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This renderer concatenates multiple untrusted data fields directly into HTML, including column names, item names, trend text, totals, and other values, without any escaping. If attacker-controlled input reaches this renderer, it can inject arbitrary HTML or script into the generated page, leading to stored or reflected XSS when the rendered chart is viewed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.