T09 · Insecure Skill Coding Practices
Warning
- Location
assets/report-template.html:232- Finding
Unescaped External Content in Generated HTML Report
- Content
View full analysis
{{TITLE}}{{AUTHOR}} · {{PUBLISH_TIME}}👍 {{LIKES}} 💬 {{COMMENTS}} 🔁 {{SHARES}} 👁 {{VIEWS}}查看原文 → ``` Similar raw placeholders also occur in the document title, keyword, timeline, topic, KOL, and analysis sections. ### Technical Analysis The template places externally sourced social-media fields directly into HTML text and attribute contexts. The audited template does not establish that these values must be HTML-escaped or that URL values must be validated before substitution. Text placeholders such as `{{TITLE}}` and `{{AUTHOR}}` can break out of their intended elements if substituted with markup. Attribute placeholders such as `{{COVER_URL}}` and `{{URL}}` are more sensitive because quote characters may terminate the attribute and introduce additional attributes or elements. A dangerous URL scheme may also be placed in an anchor if URL validation is absent. The data originates from third-party social-media search results and therefore must be treated as untrusted, even though it is returned through the RedFox API. ### Attack Path 1. An attacker publishes a social-media item containing crafted markup or attribute-breaking characters in a title, author, description, or URL-related field. 2. A user searches for a keyword that causes the malicious item to appear in the RedFox API response. 3. The Skill norm ...[truncated 1047 chars]- Remediation
View remediation