T09 · Insecure Skill Coding Practices
- Location
SKILL.md:464- Finding
Unescaped API Data in Generated HTML Reports
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 464–689 and 697–708
Vulnerability Type: HTML injection / stored cross-site scripting in generated reports
Risk Level: MediumVulnerable Code
html <title>MerkleMap OSINT Report — {{target}}</title> ... <div class="executive-summary"> {{executive_summary_paragraph}} </div> ... <tr> <td>{{cn}}</td><td>{{issuer}}</td><td>{{not_before}}</td><td>{{not_after}}</td> <td><span class="badge valid">VALID</span></td> <td>{{algo}} {{size}}</td><td><code>{{sha256}}</code></td> </tr> ... <tr><td><strong>Subject</strong></td><td>{{common_name}} — {{organization}}, {{country}}</td></tr> <tr><td><strong>Issuer</strong></td><td>{{issuer_cn}} — {{issuer_org}}, {{issuer_country}}</td></tr>text 3. **Build the HTML.** Replace all `{{placeholders}}` with real data. **Only include sections relevant to the scan** — omit empty sections entirely.Technical Analysis
The Skill instructs the agent to generate a self-contained HTML report by replacing template placeholders with data returned by the MerkleMap API. It does not require context-appropriate HTML escaping or sanitization before inserting remote values into element text, table cells, attributes, or the document title.
Certificate Transparency data can contain externally controlled certificate subject fields, including common names and organization information. Subdomain and certificate metadata must therefore be treated as untrusted. If a value contains HTML metacharacters or active markup, direct placeholder substitution can cause the browser to interpret the value as document structure rather than text.
Inline CSS and the absence of external dependencies do not prevent this issue. The supplied template also does not define a Content Security Policy that would constrain injected active content.
Attack Path
- An attacker obtains or submits a certificate whose exposed subject metadata contains crafted HTML or script-capa ...[truncated 1404 chars]
- Remediation
View remediation
Remediation Suggestions
-
Require HTML escaping for every dynamic value before template substitution. At minimum, encode:
&as&<as<>as>"as"'as'
-
Use a templating system with automatic escaping enabled rather than direct string replacement.
-
Apply output encoding according to context. Text-node encoding is insufficient for values inserted into HTML attributes, URLs, CSS, or JavaScript contexts.
-
Validate fields with narrow expected formats:
- Hostnames should conform to valid DNS-name rules.
- SHA-256 fingerprints should contain only the expected hexadecimal characters and length.
- Dates and numeric fields should be parsed and rendered from typed values.
- URLs should use an explicit allowlist of permitted schemes and hosts.
-
Avoid inserting API-returned content through
innerHTML. If report generation uses DOM APIs, assign untrusted values usingtextContent. -
Add a restrictive Content Security Policy to generated reports, for example:
html <meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; img-src data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'">- Add security tests using payloads in every remotely sourced field, including values such as:
text <img src=x onerror=alert(1)>The generated report should display the payload literally as text and must not create executable DOM elements.
- Document that all MerkleMap and Certificate Transparency data is untrusted, even when returned by an authenticated API.
-