T09 · Insecure Skill Coding Practices
Error
- Location
eval-viewer/generate_review.py:271- Finding
Stored Script Injection Through Embedded Evaluation Output
- Content
View full analysis
// ---- Embedded data (injected by generate_review.py) ---- /*__EMBEDDED_DATA__*/ ``` ### Technical Analysis Evaluation prompts, generated output files, grading evidence, and previous feedback are collected into `embedded` and serialized with `json.dumps()`. The resulting JSON is then inserted directly into an inline JavaScript block. JSON serialization alone does not make untrusted data safe for embedding in an HTML ``. A malicious or compromised Skill can create an output file containing content similar to: ```html ``` When the review HTML is generated, this content remains inside the serialized data. The browser's HTML parser terminates the original script at `` before JavaScript parsing occurs, causing the injected script element to execute. This behavior is especially dangerous because model-generated evaluation artifacts are not necessarily trustworthy. The viewer is explicitly designed to open and render those artifacts, creating a direct stored-injection path. ### Attack Path 1. A user evaluates an untrusted or compromised Skill. 2. The Skill produces a text output containing a closing `` sequence followed by attacker-controlled JavaScript. 3. `embed_file()` reads the output and stores it as the file's `content ...[truncated 1233 chars]- Remediation
View remediation
... ``` 3. Escape characters that are significant to the HTML parser before insertion, including `<`, `>`, `&`, U+2028, and U+2029. For example, replace `<` with `\u003c` in the serialized representation. 4. Read the data using `textContent` and parse it explicitly: ```javascript const EMBEDDED_DATA = JSON.parse( document.getElementById("embedded-data").textContent ); ``` 5. Add a restrictive Content Security Policy. At minimum, restrict `connect-src` to the local viewer and prevent arbitrary script execution. 6. Add regression tests using output strings containing ``, HTML tags, Unicode separators, and nested JSON content. 7. Treat all evaluation artifacts as hostile input, even when they were produced by an AI agent rather than directly supplied by a user. ]]>