T09 · Insecure Skill Coding Practices
Error
- Location
eval-viewer/generate_review.py:270- Finding
Stored Script Injection Through Embedded Evaluation Artifacts
- Content
View full analysis
// ---- Embedded data (injected by generate_review.py) ---- /*__EMBEDDED_DATA__*/ // ---- State ---- let feedbackMap = {}; ``` ### Technical Analysis `generate_html()` serializes evaluation prompts, output files, grading information, previous outputs, and previous feedback with `json.dumps()`, then inserts the result directly into an executable ``. The browser recognizes that sequence as the end of the script element even when it appears inside a JavaScript string. An evaluated Skill or other untrusted producer can place a payload such as the following in a text output: ```html ``` When `generate_review.py` reads that output and generates the review page, the payload becomes part of the inline script. Opening or refreshing the viewer executes the injected JavaScript in the viewer's origin. This is particularly dangerous because evaluation outputs are inherently untrusted: the purpose of the viewer is to display files produced by Skills and agents under test. ### Attack Path 1. An attacker supplies or influences a Skill being evaluated. 2. The Skill creates an output file under a discovered `outputs/` directory. 3. The output contains ...[truncated 1359 chars]- Remediation
View remediation
``` Then populate it with HTML-safe JSON and parse its `textContent`: ```javascript const EMBEDDED_DATA = JSON.parse( document.getElementById("embedded-data").textContent ); ``` 3. Before embedding JSON in HTML, escape at least: - `<` as `\u003c` - `>` as `\u003e` - `&` as `\u0026` - U+2028 as `\u2028` - U+2029 as `\u2029` 4. Prefer a vetted templating mechanism that applies context-aware escaping. 5. Add a restrictive Content Security Policy. Ideally, prohibit inline scripts and restrict `connect-src` to `'self'`. 6. Add regression tests using output strings containing: - `` - `