T09 · Insecure Skill Coding Practices
Error
- Location
public/script.js:264- Finding
AI-Controlled Content Rendered Through Unsafe innerHTML
- Content
View full analysis
`"${r.text}"`).join(''); } else log("❌ " + data.error); ``` ### Technical Analysis The values `r.text`, `r.timestamp`, and `r.seconds` are returned by Gemini after the model processes transcript content. They are interpolated directly into an HTML template and assigned to `innerHTML` without HTML escaping, sanitization, or schema validation. AI output must be treated as untrusted. An attacker who controls or influences the source video captions can insert prompt-injection content intended to make Gemini return HTML markup. If the returned value contains an executable element or event-handler attribute, the browser may execute it in the localhost application's origin. The backend only parses the model response as JSON: ```javascript const json = JSON.parse(result.text.replace(/```json|```/g, '')); res.json({ results: json.map(r => ({ ...r, seconds: timestampToSeconds(r.timestamp) })) }); ``` JSON parsing does not make embedded HTML safe, and the returned object is not checked against a strict schema. ### Attack Path 1. An attacker publishes or controls a YouTube video whose captions contain prompt-injection instructions. 2. The user transcribes that video through the Skill. 3. The user performs semantic search, causing the VTT content to be sent to Gemini. 4. The embedded instructions influence Gemini to return a JSON field containing malicious HTML. 5. The frontend interpolates that field into `search-results.innerHTML`. 6. ...[truncated 829 chars]
Jump to ${r.timestamp} ➔- Remediation
View remediation