T03 · Remote Payload Retrieval and Execution
Warning
- Location
assets/templates/problem.html:6- Finding
Unpinned Remote JavaScript Executes During Local Slide Rendering
- Content
View full analysis
``` The affected HTML files are rendered through the following command in `scripts/html2png.sh:13-16`: ```bash google-chrome --headless --disable-gpu \ --screenshot="$OUTPUT" \ --window-size=1200,675 \ "file://$INPUT" 2>/dev/null ``` ### Technical Analysis Each supplied HTML template and example loads JavaScript from `https://cdn.tailwindcss.com` at rendering time. The URL is not pinned to an immutable version, and no Subresource Integrity metadata is provided. Consequently, the code that executes in headless Chrome can change after the Skill package has been reviewed. This is a remote payload execution channel rather than a purely static stylesheet dependency. When `html2png.sh` opens a generated slide, Chrome retrieves the current CDN response and executes it in the local slide page. If the CDN, its delivery path, or the referenced resource is compromised, attacker-controlled JavaScript could execute in the page context. The Google Fonts stylesheet also creates an outbound dependency and reduces rendering determinism, although the reviewed project does not contain evidence that it directly transmits sensitive slide data. No currently malicious CDN payload or deliberate exfiltration logic was found in the repository. The vulnerability is the trust placed in mutable remote code during local rendering. ### Attac ...[truncated 1534 chars]- Remediation
View remediation
` elements and unexpected external resource URLs in generated slides. 8. Revalidate screenshots after dependency updates and retain reviewed dependency artifacts to support reproducible builds. ]]>