T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_visual.py:382- Finding
Stored HTML Injection Through an Unvalidated Checklist Status
- Content
View full analysis
{_h(c.get('text', ''))} {_h(status)}\n" ``` ### Technical Analysis The `checklist[].status` value originates from parsed JSON and is inserted directly into the quoted `class` attribute. Although the summary prompt asks the model to return only `ready`, `pending`, or `blocked`, the implementation does not enforce that allowlist. The visible status text is escaped through `_h(status)`, but the copy embedded in the `class` attribute is not escaped. A malicious value containing a quotation mark can terminate the attribute and introduce new attributes or HTML elements. For example, a crafted status value conceptually similar to the following could introduce an image with an error handler: ```text x">- Remediation
View remediation
{_h(c.get("text", ""))} ' f'{_h(status)}\n' ) ``` 3. Validate the complete inference response against a JSON schema before passing it to any renderer. Validate field types, required properties, string lengths, array lengths, and enum values. 4. Prefer a proper template engine with context-aware escaping rather than manual string replacement. 5. Add a restrictive Content Security Policy. Because the current template contains inline JavaScript, move that code to a local script or authorize it with a nonce or hash. At minimum, prohibit inline event handlers and remote connections. 6. Add regression tests using quotation marks, angle brackets, event-handler attributes, malformed types, and oversized values in every model-generated field. ]]>