T09 · Insecure Skill Coding Practices
Warning
- Location
assets/plan_template.html:115- Finding
Unescaped User-Controlled Values in Generated HTML Reports
- Content
View full analysis
{{ACTIVITY_NAME}}
{{ACTIVITY_THEME}}{{ACTIVITY_TYPE}} | {{ACTIVITY_DATE}} | {{ACTIVITY_LOCATION}}``` Additional affected interpolation contexts include: ```html {{ACTIVITY_NAME}} - 活动策划方案 ``` ```html{{ACTIVITY_NAME}}{{ACTIVITY_THEME}}{{ACTIVITY_DATE}}{{ACTIVITY_LOCATION}}{{ACTIVITY_GOALS}}
``` ### Technical Analysis The Skill instructs the Agent to collect event names, themes, dates, locations, goals, and other values from the user, and then use `assets/plan_template.html` to produce a shareable HTML report. These user-derived values are inserted directly into HTML text and title contexts. Neither the template nor the workflow in `SKILL.md` requires context-sensitive HTML escaping or sanitization. If a replacement value is copied literally, an attacker can terminate the intended HTML context and inject arbitrary markup. For example, a malicious activity name could contain: ```html``` When inserted without escaping, this changes the structure of the generated document and creates an executable `script` element. Similar payloads could inject event-handler attributes, external resources, deceptive forms, redirects, or other active content. The template also contains placeholders intended to hold larger HTML fragments, such as `{{STRATEGY_CONTENT}}` and `{{CREATIVE_CONTENT}}`. These require an ...[truncated 1691 chars]
- Remediation
View remediation
` as `>`. - Encode quotation marks when values are used in attributes. - Use a template engine with automatic escaping enabled rather than raw string replacement. 2. **Separate plain-text values from trusted rich-content fragments.** - Treat fields such as activity name, theme, date, location, goals, budget values, and participant counts exclusively as text. - Do not permit these fields to produce HTML elements. 3. **Sanitize intentionally generated HTML fragments.** Apply a strict allowlist to placeholders such as `{{STRATEGY_CONTENT}}`, `{{CREATIVE_CONTENT}}`, and `{{PROMOTION_CONTENT}}`. Permit only necessary formatting elements and safe attributes. Remove: - `script`, `iframe`, `object`, `embed`, and similar active elements. - Inline event handlers such as `onclick` and `onerror`. - `javascript:`, unsafe `data:`, and other active URL schemes. - Form controls, navigation elements, and external resources unless explicitly required. 4. **Add an explicit security requirement to `SKILL.md`.** Require all user-provided and generated text to be escaped before insertion and prohibit direct interpolation of untrusted HTML. 5. **Add a restrictive Content Security Policy where practical.** A suitable baseline for this self-contained template is: ```html ``` This is defense in depth and does not replace escaping or sanitization. 6. **Test with adversarial input.** Include regression cases containing closing tags, script elements, event handlers, encoded markup, malformed tags, and dangerous URL schemes. Verify that every payload appears as inert text in the gene ...[truncated 17 chars]