T03 · Remote Payload Retrieval and Execution
Warning
- Location
- templates/viewer.html:23
- Finding
- Integrity-Unpinned Remote JavaScript Is Executed at Runtime<![CDATA[ ## Vulnerability Details **File Locations**: - `templates/viewer.html:23` - `SKILL.md:278-281` **Vulnerability Type**: Runtime retrieval and execution of externally hosted code without integrity verification **Risk Level**: Medium ### Vulnerable Code `templates/viewer.html:23`: ```html <script src="https://cdnjs.cloudflare.com/ajax/libs/p5.js/1.7.0/p5.min.js"></script> ``` `SKILL.md:278-281`: ```html <head> <!-- p5.js from CDN - always available --> <script src="https://cdnjs.cloudflare.com/ajax/libs/p5.js/1.7.0/p5.min.js"></script> <style> ``` ### Technical Analysis The supplied viewer template loads and executes p5.js from a third-party CDN whenever the generated HTML artifact is opened. The Skill documentation explicitly directs generated artifacts to use the same external script. Although the URL identifies p5.js version 1.7.0, the script element does not include a Subresource Integrity (`integrity`) hash. Consequently, the browser verifies the HTTPS connection but does not verify that the returned JavaScript matches the dependency content reviewed during this audit. The effective executable payload can therefore change independently of the audited project. This behavior also conflicts with the documentation's characterization of the resulting artifact as self-contained. The artifact depends on external JavaScript at runtime and cannot operate as represented without network access or a cached dependency. ### Attack Path 1. An agent follows `SKILL.md` and creates an HTML artifact from `templates/viewer.html`. 2. A user opens the generated artifact in a web browser. 3. The browser requests `p5.min.js` from the external cdnjs endpoint. 4. An attacker compromises the upstream resource, CDN delivery path, or another component capable of changing the response. 5. Because no SRI hash is present, the browser accepts and executes the modified JavaScript. 6. The malicious script runs in the generated artifact's browser execution context and c ...[truncated 783 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Prefer local bundling** - Include a reviewed copy of p5.js directly in the generated artifact or package it as a trusted local dependency. - This is the preferred approach because the Skill promises a self-contained artifact. - Record the dependency version and cryptographic checksum used during bundling. 2. **Use Subresource Integrity if remote hosting is retained** - Obtain the official SHA-384 or SHA-512 digest for the exact p5.js 1.7.0 resource. - Add the verified digest and an appropriate CORS mode: ```html <script src="https://cdnjs.cloudflare.com/ajax/libs/p5.js/1.7.0/p5.min.js" integrity="sha384-REPLACE_WITH_VERIFIED_OFFICIAL_DIGEST" crossorigin="anonymous"></script> ``` - Do not insert an unverified or manually guessed digest. 3. **Apply a restrictive Content Security Policy** - Restrict `script-src` to the minimum required sources. - Avoid `unsafe-eval` and dynamically generated executable code. - Restrict `connect-src`, `img-src`, `font-src`, and other directives according to actual artifact requirements. 4. **Update the Skill instructions** - Replace the mandatory CDN example in `SKILL.md:278-281` with the hardened implementation. - If external dependencies remain necessary, remove or qualify claims that artifacts are completely self-contained and work without setup. 5. **Bundle fonts where practical** - `templates/viewer.html:24-26` also contacts Google Fonts. Bundling these resources would reduce external trust dependencies and prevent disclosure of routine request metadata to another third party. ]]>