T03 · Remote Payload Retrieval and Execution
Warning
- Location
SKILL.md:479- Finding
Generated Documents Execute Mutable Third-Party JavaScript Without Integrity Verification
- Content
View full analysis
``` ```html ``` Additional remote executable dependencies include: ```html ``` ```html ``` ```html ``` ### Technical Analysis The Skill directs generated HTML documents to retrieve and execute JavaScript from public CDNs. None of the demonstrated script elements use Subresource Integrity through an `integrity` attribute, and no restrictive Content Security Policy is specified. The Prism autoloader also retrieves additional executable components dynamically from a remote directory. The Mermaid reference uses the mutable major-version selector `@10` instead of an immutable, exact rele ...[truncated 1972 chars]- Remediation
View remediation
``` 4. Avoid runtime dependency autoloaders. Bundle only the language components required by the document. 5. Add a restrictive Content Security Policy that limits scripts and outbound connections to explicitly approved sources. Prefer external, hashed scripts over inline scripts. 6. Maintain an inventory of dependency names, exact versions, hashes, licenses, and review dates. 7. Periodically scan the pinned dependencies for known vulnerabilities and update them through a controlled review process. 8. For sensitive or offline technical documents, self-host fonts and scripts and disable unnecessary outbound network requests entirely. ]]>