T03 · Remote Payload Retrieval and Execution
Warning
- Location
templates/viewer.html:23- Finding
Integrity-Unpinned Remote JavaScript Is Executed at Runtime
- Content
View full analysis
``` `SKILL.md:278-281`: ```html ``` ### Technical Analysis The supplied viewer template loads and executes p5.js from a third-party CDN whenever the generated HTML artifact is opened. The Skill documentation explicitly directs generated artifacts to use the same external script. Although the URL identifies p5.js version 1.7.0, the script element does not include a Subresource Integrity (`integrity`) hash. Consequently, the browser verifies the HTTPS connection but does not verify that the returned JavaScript matches the dependency content reviewed during this audit. The effective executable payload can therefore change independently of the audited project. This behavior also conflicts with the documentation's characterization of the resulting artifact as self-contained. The artifact depends on external JavaScript at runtime and cannot operate as represented without network access or a cached dependency. ### Attack Path 1. An agent follows `SKILL.md` and creates an HTML artifact from `templates/viewer.html`. 2. A user opens the generated artifact in a web browser. 3. The browser requests `p5.min.js` from the external cdnjs endpoint. 4. An attacker compromises the upstream resource, CDN delivery path, or another component capable of changing the response. 5. Because no SRI hash is present, the browser accepts and executes the modified JavaScript. 6. The malicious script runs in the generated artifact's browser execution context and c ...[truncated 783 chars]- Remediation
View remediation
``` - Do not insert an unverified or manually guessed digest. 3. **Apply a restrictive Content Security Policy** - Restrict `script-src` to the minimum required sources. - Avoid `unsafe-eval` and dynamically generated executable code. - Restrict `connect-src`, `img-src`, `font-src`, and other directives according to actual artifact requirements. 4. **Update the Skill instructions** - Replace the mandatory CDN example in `SKILL.md:278-281` with the hardened implementation. - If external dependencies remain necessary, remove or qualify claims that artifacts are completely self-contained and work without setup. 5. **Bundle fonts where practical** - `templates/viewer.html:24-26` also contacts Google Fonts. Bundling these resources would reduce external trust dependencies and prevent disclosure of routine request metadata to another third party. ]]>