T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/collector.js:183- Finding
Untrusted Podcast Metadata Is Written to Markdown Without Sanitization
- Content
View full analysis
({ title: item.trackName, link: item.trackViewUrl, publishDate: item.releaseDate, summary: item.description || item.trackName, author: item.artistName })) || [] ``` The untrusted values are then interpolated directly into the generated Markdown report: ```js md += `### ${item.title || 'Untitled'}\n\n`; md += `- **Platform:** ${item.platform}\n`; md += `- **Published:** ${item.publishDate ? new Date(item.publishDate).toLocaleDateString() : 'Unknown'}\n`; md += `- **Link:** ${item.link || 'N/A'}\n`; md += `- **Summary:** ${item.summary || 'No summary available'}\n`; ``` ### Technical Analysis The collector treats metadata returned by the external iTunes Search API as trusted content. Podcast titles, descriptions, authors, and related metadata can ultimately be controlled or influenced by podcast publishers. These values are inserted into Markdown without escaping Markdown metacharacters, removing raw HTML, or validating URL schemes and destinations. An attacker-controlled title or description could therefore alter the structure and presentation of a generated report. Depending on the Markdown renderer, injected content could include deceptive links, images that trigger external requests, or raw HTML. If an AI agent later processes the generated report as instructions rather than untrusted reference data, the same channel can carry stored prompt-injection text. This issue does not directly provide shell execution, filesystem traversal, privilege escalation, or operating-system access. Exploitation depends on a malicious result being returned for one of the configured search terms and on the ge ...[truncated 1705 chars]- Remediation
View remediation