T09 · Insecure Skill Coding Practices
- Location
SKILL.md:17- Finding
Unsanitized User Input in Generated and Deployed HTML
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 17-21, 138-142, and 172-179
Vulnerability Type: Stored cross-site scripting through unsafe HTML generation
Risk Level: HighVulnerable Code Snippets
markdown 读取用户提供的数据（文字/表格/JSON），确定： - 有哪些指标/字段 - 数据类型（数值/文本/时间序列） - 适合的图表类型html <title>{报告标题}</title> <style>html <body> {内容区} </body> </html>bash # 保存HTML write /workspace/{project}/index.html # 部署 deploy --dist_dir /workspace/{project} --project_name {项目名}Technical Analysis
The documented workflow accepts arbitrary user-provided text, tables, or JSON and interpolates generated content into an HTML template. In particular, the report title is inserted into the
titleelement and the report body is inserted into{内容区}. The resulting file is then deployed.The instructions do not require contextual HTML encoding, markup sanitization, safe DOM construction, URL-scheme validation, or a Content Security Policy. If attacker-controlled fields are copied into the template as HTML, they can break out of their intended context and introduce active content such as
scriptelements, inline event handlers, dangerous URL schemes, or deceptive forms.This is a stored cross-site scripting risk because the malicious input may be embedded in the generated report, persisted in the deployed HTML file, and executed whenever another user visits the deployment.
Attack Path
- An attacker supplies report data containing an HTML payload, for example:
html <img src="x" onerror="alert(document.domain)"> - The Skill processes the value as report content without a documented escaping or sanitization step.
- The payload is inserted into
{内容区}or another generated HTML context. - The generated document is written to
/workspace/{project}/index.html. - The project directory is deployed and a public or shared link is re ...[truncated 1261 chars]
- An attacker supplies report data containing an HTML payload, for example:
- Remediation
View remediation
Remediation Suggestions
- Treat every value derived from user-provided text, tables, and JSON as untrusted.
- HTML-encode plain-text values according to their output context, including element text, attribute values, URLs, CSS, and JavaScript contexts. Avoid implementing contextual escaping through ad hoc string replacement.
- Construct the report from fixed templates and text-only placeholders. Use safe DOM APIs such as
textContentrather thaninnerHTMLwhen client-side rendering is required. - If limited rich text is necessary, sanitize it with a maintained HTML sanitizer and a strict allowlist. Disallow at minimum:
script,iframe,object,embed,form, andbaseelements.- Inline event attributes such as
onerrorandonclick. javascript:, unsafedata:, and other executable URL schemes.- Untrusted inline styles or SVG content unless separately sanitized.
- Validate generated links and permit only explicitly approved schemes such as
https:. - Apply a restrictive Content Security Policy, for example one that blocks inline scripts, plugins, framing, and unauthorized external connections. Use nonces or hashes if scripts are required.
- Deploy each generated report on an origin isolated from authenticated or sensitive applications. Do not expose privileged cookies to the report origin.
- Add adversarial tests covering closing tags, event handlers, malformed markup, SVG payloads, encoded URL schemes, and injections into title, body, attribute, and style contexts.
- Preview the sanitized output and require explicit confirmation before public deployment.
- Document the sanitization and encoding requirements directly in the Skill's generation workflow so they cannot be omitted by an implementation.