T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/format_report.py:81- Finding
Unsanitized Remote Release Notes Embedded in Markdown Reports
- Content
View full analysis
]+>', '', body) # Get first non-empty lines up to 400 chars paras = [p.strip() for p in body.split("\n") if p.strip()] snippet = " ".join(paras)[:400] if len(" ".join(paras)) > 400: snippet += "…" ``` ```python if source_url or gh_repo: url = source_url or f"https://github.com/{gh_repo}" lines.append(f"- **Source:** <{url}>") lines.append("") lines.append("**Changelog:**") lines.append(changelog_summary) return "\n".join(lines) ``` ### Technical Analysis Release-note bodies retrieved from GitHub are controlled by the referenced repository and must therefore be treated as untrusted remote input. The formatter removes HTML tags, but it does not escape or remove Markdown constructs such as: - Remote images: `` - Deceptive hyperlinks: `[Security update](https://attacker.example/phish)` - Headings, block quotes, and other formatting capable of visually altering the report - Control characters or crafted text intended to obscure the report's trusted risk labels The resulting content is inserted directly into the generated Markdown report. HTML removal alone is insufficient because Markdown renderers can turn the remaining syntax into active external resources and misleading interactive content. This issue does not p ...[truncated 1804 chars]- Remediation
View remediation
//releases` URL. 7. Add tests containing malicious examples such as remote images, phishing links, headings, tables, nested formatting, and control characters. 8. Document that changelog text originates from an external repository and is not trusted by the Skill. ]]>