T08 · Insecure Dependencies
- Location
SKILL.md:110- Finding
Unrestricted Third-Party Font Retrieval
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:110
Vulnerability Type: Untrusted third-party dependency retrieval
Risk Level: MediumComplete Code Snippet:
markdown Download and use whatever fonts are needed to make this a reality. Get creative by making the typography actually part of the art itself -- if the art is abstract, bring the font onto the canvas, not typeset digitally.Technical Analysis
The skill instructs the agent to download arbitrary fonts without defining approved sources, exact versions, cryptographic hashes, signature checks, or file-validation requirements. Although the project includes font license files under
canvas-fonts/, the audited directory structure does not contain corresponding font binaries. Following this instruction may therefore introduce externally sourced binary files into the artwork-generation workflow.Font files are complex third-party inputs processed by font parsers, graphics libraries, and document-rendering software. Retrieving them from unrestricted sources creates a supply-chain risk: a compromised, impersonated, or attacker-controlled source could distribute a substituted or specially crafted font. The project does not itself identify a malicious source, ship a malicious payload, or direct the agent to execute downloaded code; the risk arises from the unsafe dependency-acquisition policy.
Attack Path
- The skill is invoked for artwork requiring typography.
- The available directory lacks the required font binary, or the agent elects to use another font.
- Following
SKILL.md:110, the agent searches an unrestricted external source and downloads a font. - An attacker-controlled, compromised, or spoofed source supplies a substituted or crafted font file.
- The agent loads the file into a font parser, image-generation library, or PDF renderer.
- If that processing component contains a relevant parser vulnerability, the ...[truncated 838 chars]
- Remediation
View remediation
Remediation Suggestions
- Bundle all approved font binaries with the skill rather than downloading them at runtime.
- If external retrieval is necessary, allowlist official publisher repositories and require HTTPS with certificate validation.
- Pin each font to an exact release and verify a documented SHA-256 or stronger cryptographic digest before processing.
- Validate the downloaded file's actual format, size, and expected metadata instead of relying on its extension or server-provided content type.
- Reject archives containing path traversal entries, symbolic links, executables, or unrelated files.
- Use fully patched font-processing and rendering libraries.
- Parse external fonts in a sandbox with minimal filesystem permissions, no credentials, resource limits, and no network access after retrieval.
- Record the font source, version, license, and verified digest to support reproducible builds and later audits.
- Replace the unrestricted instruction with an explicit policy requiring bundled fonts first and approved, integrity-verified sources only as a controlled fallback.