T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/summary_generator.py:16
- Finding
- Unsanitized Feishu Content Injection into Generated Markdown Reports## Vulnerability Details **File Location**: `scripts/summary_generator.py:16-20`, `scripts/summary_generator.py:30-34`, and `scripts/summary_generator.py:49-65` **Vulnerability Type**: Markdown content injection caused by missing output encoding **Risk Level**: Medium ### Vulnerable Code ```python return f"""# {folder_name} Document Summary Report **Source:** {url} **Generated:** {timestamp} **Total Documents:** {total_docs} ``` ```python def add_node(node: Dict, prefix: str = "", is_last: bool = True): connector = "└── " if is_last else "├── " tree_line = f"{prefix}{connector}{node['title']}\n" nonlocal tree tree += tree_line ``` ```python def generate_document_summary(doc: Dict, index: str) -> str: """Generate summary for a single document.""" title = doc.get('title', 'Untitled') doc_type = doc.get('type', 'unknown') status = doc.get('status', 'unknown') summary = doc.get('summary', 'No summary available') status_emoji = { 'complete': '✅', 'in_progress': '🚧', 'empty': '⚠️', 'unknown': '❓' }.get(status, '❓') return f"""### {index} {title} - **Type:** {doc_type} - **Status:** {status_emoji} {status.replace('_', ' ').title()} - **Summary:** {summary} ``` ### Technical Analysis The report generator directly interpolates the source URL, folder name, document titles, document types, and generated summaries into Markdown without contextual escaping or validation. In particular, document titles are also inserted inside a fenced code block used for the directory tree. A title containing newline characters and a closing triple-backtick sequence can terminate that block and inject arbitrary Markdown into the remainder of the report. Titles and summaries inserted outside the code block can directly introduce headings, links, images, HTML supported by the renderer, or other deceptive formattin ...[truncated 2195 chars]
- Remediation
- ## Remediation Suggestions 1. Introduce context-specific Markdown escaping for all untrusted values, including `folder_name`, `url`, `node['title']`, `title`, `doc_type`, and `summary`. 2. For directory-tree entries, normalize carriage returns and newline characters and neutralize all backtick sequences before placing values inside the fenced code block. Alternatively, generate the tree as escaped list items rather than as a code fence. 3. Prevent summaries and titles from introducing raw HTML, links, images, headings, or block-level Markdown unless those features are explicitly required. 4. Validate source URLs with a URL parser. Require HTTPS and an expected Feishu hostname rather than relying on string-pattern matching. 5. If links are required, construct them from validated components and apply URL encoding rather than inserting an arbitrary supplied URL. 6. Configure the final Markdown renderer to disable raw HTML and automatic remote resource loading where possible. 7. Add tests using hostile inputs, including embedded newlines, triple backticks, image syntax, HTML tags, deceptive links, and bidirectional control characters. 8. Treat all fetched Feishu content as untrusted data. The skill instructions should explicitly state that instructions embedded in documents must be summarized as content and must never be followed as agent directives.