T09 · Insecure Skill Coding Practices
Error
- Location
scripts/kuaishou_comment_search.py:137- Finding
Stored HTML and Script Injection in Generated Reports
- Content
View full analysis
' f'' f'' f'' f'' ) ``` AI-generated analysis summaries are also inserted as raw HTML: ```python summary_map = { "{{SUMMARY_POSITIVE}}": analysis.get("positive_summary", ""), "{{SUMMARY_NEGATIVE}}": analysis.get("negative_summary", ""), "{{SUMMARY_DEMAND}}": analysis.get("demand_summary", ""), "{{SUMMARY_COMPETITOR}}": analysis.get("competitor_summary", ""), } for key, val in summary_map.items(): html = html.replace(key, val) ``` The consolidated report generator uses the same unsafe pattern: ```python "{{POSITIVE_RATIO}}": str(analysis.get("positive_ratio", "--")), "{{NEGATIVE_RATIO}}": str(analysis.get("negative_ratio", "--")), "{{DEMAND_RATIO}}": str(analysis.get("demand_ratio", "--")), "{{COMPETITOR_RATIO}}": str(analysis.get("competitor_ratio", "--")), "{{SUMMARY_POSITIVE}}": analysis.get("positive_summary", ""), "{{SUMMARY_NEG ...[truncated 3101 chars]' f'{name}{pin_badge}' f'
- Remediation
View remediation
` and `- ` elements internally. 5. If formatted summary HTML must be supported, sanitize it with a strict allowlist that permits only necessary elements and no attributes. 6. Validate ratio fields as bounded numeric values rather than inserting arbitrary strings. 7. Add a restrictive Content Security Policy that blocks inline event handlers, unapproved scripts, and unapproved network destinations. 8. Add tests containing quotation marks, event handlers, `