HTML Coder

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:12 PM UTC
• Version: 2.0.1

Overview

This is a static HTML reference skill whose risky-looking content is mainly ordinary web-development examples, not hidden behavior by the skill itself.

Before installing, treat this as a documentation helper: review generated HTML before production use, avoid blindly copying CDN or global npm examples, pin third-party dependencies, add integrity checks where supported, and set language/accessibility attributes for your actual content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: references/add-css-style.md:319

Finding

Unpinned Third-Party CSS Framework Resources Without Subresource Integrity

Content

View full analysis

``` ```html ``` ```html ``` ### Technical Analysis These examples load executable JavaScript and stylesheets directly from third-party CDNs. The resources do not use Subresource Integrity hashes, and the Tailwind URL is not pinned to an immutable version. Consequently, the effective content can change after the Skill has been reviewed. Although the Skill separately recommends SRI as a best practice, its directly reusable framework examples do not consistently implement that recommendation. If an upstream package, CDN, publishing account, or mutable resource is compromised, generated pages that copy these examples will execute or apply attacker-controlled content. The Skill only needs to provide HTML development guidance. Automatic reliance on mutable third-party executable resources is not necessary for that functionality and exceeds the minimum-risk approach. ### Attack Path 1. A user requests a page using Bootstrap or Tailwind CSS. 2. The Agent copies one of the documented CDN integration examples. 3. The generated page loads the dependency when opened in a browser. 4. An attacker compromises the CDN, package publisher, or mutable resource. 5. The browser retrieves the modified resource because no integrity hash constrains its content. 6. Malicious JavaScript executes in the page origin and can access data and browser capabilities available to that page. ### Impact Assessment A compromised JavaScript dependency could execute arbitrary code in the browser context of every visitor to the aff ...[truncated 471 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: references/add-javascript.md:465

Finding

Third-Party JavaScript Frameworks Loaded Without Subresource Integrity

Content

View full analysis

``` ```html ``` ```html ``` ### Technical Analysis The examples load executable JavaScript from third-party package CDNs without Subresource Integrity. They use floating major-version selectors such as `react@18` and `vue@3`; the Babel URL does not specify a version at all. Those URLs can resolve to different package releases over time, allowing the effective code to change after audit. The `crossorigin` attribute controls cross-origin request behavior but does not verify resource authenticity or immutability. Without a valid `integrity` value, the browser will execute any content returned by the allowed URL. This is inconsistent with the same document's recommendation to use SRI for CDN scripts. Because framework integration can be demonstrated using pinned or self-hosted assets, mutable remote execution is not required by the Skill's declared HTML-development functionality. ### Attack Path 1. A user asks the Agent to generate a React, Vue, or Babel-based page. 2. The Agent reproduces one of the documented framework examples. 3. The resulting page requests JavaScript from unpkg or j ...[truncated 1036 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: references/standards.md:494

Finding

Unpinned Global npm Package Installation in Validation Guidance

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (24)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

- [`references/global-attributes.md`](references/global-attributes.md) - Complete global attribute information

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/add-css-style.md (reported line 152)May include surrounding context.

Load different CSS files for different devices:

html

<!-- Mobile-first approach -->
<link rel="stylesheet" href="base.css">
<link rel="stylesheet" href="tablet.css" media="(min-width: 768px)">
<link rel="stylesheet" href="desktop.css" media="(min-width: 1024px)">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/add-css-style.md (reported line 539)May include surrounding context.

md

<link rel="preconnect" href="https://fonts.googleapis.com">
  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
  
  <!-- Critical CSS inline -->
  <style>
    body {
      margin: 0;

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/add-javascript.md (reported line 22)May include surrounding context.

md

<h1 id="heading">Hello World</h1>
  <button id="changeBtn">Change Text</button>
  
  <!-- Script at end of body -->
  <script src="script.js"></script>
</body>
</html>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/add-javascript.md (reported line 88)May include surrounding context.

md

<!-- Inline onclick -->
<button onclick="alert('Clicked!')">Click Me</button>

<!-- Inline with parameters -->
<button onclick="greet('John')">Greet John</button>

<script>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/add-javascript.md (reported line 157)May include surrounding context.

html

<head>
  <script src="script.js" defer></script>
  <!-- HTML parsing continues -->
</head>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/add-javascript.md (reported line 464)May include surrounding context.

md

integrity="sha256-/JqT3SQfawRcv/BIHPThkBvs0OEvtFFmqPF/lYI/Cxo=" 
          crossorigin="anonymous"></script>
  
  <!-- React -->
  <script crossorigin src="https://unpkg.com/react@18/umd/react.production.min.js"></script>
  <script crossorigin src="https://unpkg.com/react-dom@18/umd/react-dom.production.min.js"></script>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/essentials.md (reported line 11)May include surrounding context.

Syntax:

html

<!-- Single line comment -->

<!--
  Multi-line comment

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/glossary.md (reported line 347)May include surrounding context.

Lists

html

<!-- Unordered -->
<ul>
  <li>Item 1</li>
  <li>Item 2</li>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/glossary.md (reported line 884)May include surrounding context.

md

<!-- Links -->
<a href="url" target="_blank" rel="noopener">Link</a>

<!-- Images -->
<img src="image.jpg" alt="Description" width="800" height="600" loading="lazy">

<!-- Forms -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/glossary.md (reported line 896)May include surrounding context.

md

<!-- Containers -->
<div id="container" class="wrapper" data-role="main"></div>

<!-- Media -->
<video src="video.mp4" controls poster="poster.jpg" preload="metadata"></video>

<!-- Scripts -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/glossary.md (reported line 902)May include surrounding context.

```

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/glossary.md (reported line 1255)May include surrounding context.

md

<form onsubmit="return false">...</form>
<form onsubmit="event.preventDefault()">...</form>

<!-- Prevent link navigation -->
<a href="#" onclick="return false">Don't navigate</a>

<!-- Prevent right-click menu -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/glossary.md (reported line 1271)May include surrounding context.

Click

Click

text

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/glossary.md (reported line 1316)May include surrounding context.

md

<!-- ❌ Inline: Limited to one handler -->
<button onclick="doA()">Click</button>

<!-- ✅ addEventListener: Multiple handlers -->
<button id="btn">Click</button>
<script>
  const btn = document.getElementById('btn');

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/glossary.md (reported line 1332)May include surrounding context.

md

<!-- ❌ Inline: Mixed HTML and JavaScript -->
<button onclick="alert('Clicked')">Click</button>

<!-- ✅ Separate: Clean HTML, JS in script -->
<button id="myBtn">Click</button>
<script>
  document.getElementById('myBtn').addEventListener('click', function() {

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/glossary.md (reported line 1347)May include surrounding context.

md

<!-- ❌ Inline: Blocked by strict CSP -->
<button onclick="alert('Blocked')">Click</button>

<!-- ✅ External: Allowed by CSP -->
<button id="btn">Click</button>
<script src="app.js"></script>
<!-- app.js: document.getElementById('btn').addEventListener('click', ...) -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/standards.md (reported line 34)May include surrounding context.

Page Title ```

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/add-javascript.md (reported line 526)May include surrounding context.

```

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description says to use the skill for broad situations like "creating HTML documents" or "needing HTML templates, best practices, and accessibility guidance." Those triggers are wide in scope and do not define exclusion conditions or clear boundaries for when this skill should not activate, which can cause unintended invocation for ordinary frontend questions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The examples include third-party CDN-hosted CSS/JS resources such as jsDelivr, Tailwind CDN, Google Fonts, and Normalize.css without warning that using them causes external network requests and may expose users' IP address, user agent, referrer, and other metadata to those providers. In a reference skill, readers may copy-paste these snippets directly into production pages, so the omission can lead to unintended privacy, supply-chain, and availability risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file repeatedly uses lang="en" in example HTML documents, which encodes a specific language/locale choice in natural-language-adjacent configuration. Because the guide does not mention that this is merely illustrative or encourage adapting the lang value to the user's actual content language, it can be read as forcing English by default.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The 'Don't' section explicitly instructs readers not to use inline event handlers and not to use document.write(), yet earlier examples demonstrate both patterns as implementation techniques. Although some examples are labeled as quick prototypes or fallback patterns, this still creates a direct documentation-level contradiction between the prescriptive guidance and the included code examples.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The internationalization example hard-codes <html lang="en" dir="ltr"> as the top-level document language, which can be read as prescribing English as the default language rather than presenting it as one example among user-selected options. This is a mild natural-language locale policy concern because the file does not explicitly state that language choice should reflect user or content needs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.