T03 · Remote Payload Retrieval and Execution
Error
- Location
system-prompt.md:107- Finding
Generated Prototypes Execute Mutable Third-Party Code from a Remote CDN
- Content
View full analysis
import React from 'https://esm.sh/react@18.3.1'; import { createRoot } from 'https://esm.sh/react-dom@18.3.1/client'; import { Button } from 'https://esm.sh/@?deps=react@18.3.1,react-dom@18.3.1&bundle-deps'; ``` ### Technical Analysis The Skill directs generated prototypes to import and execute JavaScript from `esm.sh` at page-load time. Although some package versions are shown, the component-library version remains a placeholder, and none of the remote resources are protected by a locally audited bundle, cryptographic integrity check, or immutable artifact policy. JavaScript imported as an ES module executes in the security context of the generated prototype. Consequently, a compromised CDN response, malicious package release, dependency-confusion event, or compromised transitive dependency can inspect and modify the page DOM, read prototype data available to the page, alter validation results, and issue outbound network requests. The `bundle-deps` option changes dependency delivery behavior but does not establish trust or integrity. Because the effective code is retrieved after the Skill package has been reviewed, its behavior can change independently of the audited artifact. ### Attack Path 1. The Skill generates a prototype containing the prescribed `esm.sh` imports. 2. The agent starts the local preview server and opens the generated page in a browser. 3. The browser requests executable modules from `esm.sh`. 4. An attacker compromises the CDN response, publishes or substitutes a malicious dependency version, or compromises a transitive package. 5. The malicious module executes in the generated page's origin. 6. The module reads or modifies prototype cont ...[truncated 823 chars]- Remediation
View remediation
` or any other unresolved dependency placeholder remains in an executable URL. ]]>