T03 · Remote Payload Retrieval and Execution
Warning
- Location
assets/standalone-chart.template.html:406- Finding
Generated chart pages retrieve and execute mutable remote JavaScript
- Content
View full analysis
entry.trim()) .filter(Boolean); return Array.from(new Set([...configured, ...fallbackUrls])); } function loadScript(src) { return new Promise((resolve, reject) => { const script = document.createElement("script"); script.src = src; script.async = true; script.onload = () => resolve(window.echarts); script.onerror = () => { script.remove(); reject(new Error(`Could not load ${src}`)); }; document.head.appendChild(script); }); } ``` The related default URL is: ```javascript const DEFAULT_CDN = "https://cdn.jsdelivr.net/npm/echarts@5/dist/echarts.min.js"; ``` ### Technical Analysis Every generated `chart.html` dynamically creates a `script` element and executes JavaScript obtained from a public CDN. The default jsDelivr and unpkg URLs use the mutable major-version selector `echarts@5`, so the effective code can change after the Skill package has been reviewed. The template also provides automatic fallback across three external providers. No Subresource Integrity hash is assigned to the script, and the generated page does not enforce a restrictive Content Security Policy. Consequently, the browser cannot verify that the retrieved script is the exact artifact intended by the Skill author. The `--cdn` ...[truncated 2547 chars]- Remediation
View remediation