T09 · Insecure Skill Coding Practices
Warning
- Location
skill.py:84- Finding
Unsanitized Agent Name Allows HTML Injection into Generated Markdown
- Content
View full analysis
[ {agent_name} ]
{AVATARS[avatar_choice]}
``` ### Technical Analysis The skill accepts an arbitrary agent name through `input()` and performs only whitespace trimming and uppercase conversion. It does not validate the permitted character set, restrict the input length, or HTML-escape the value. The value is then interpolated into an `` element in the generated Markdown. Because the output intentionally contains raw HTML and users are instructed to copy it into Markdown-capable applications, a crafted name can close the existing element and introduce additional attacker-controlled HTML. For example, an input conceptually shaped like the following can introduce a remote resource: ```html
``` Calling `.upper()` does not neutralize HTML because tag and attribute names are generally case-insensitive in HTML. The precise behavior depends on the destination Markdown renderer: some remove unsafe HTML, while permissive renderers may load injected remote resources or allow other active content. ### Attack Path 1. An attacker persuades a user to enter a specially crafted agent name or supplies the value in an automated execution environment. 2. The skill accepts the value without validation or output encoding. 3. The value is inserted into the raw HTML section of `md_output`. 4. The skill instructs the user to copy the generated Mark ...[truncated 880 chars]
- Remediation
View remediation
[ {safe_agent_name} ] ``` 2. Apply strict allowlist validation if agent names are intended to be identifiers rather than free-form text: ```python import re if not re.fullmatch(r"[A-Z0-9_-]{1,64}", agent_name): raise ValueError( "Agent names may contain only letters, digits, underscores, and hyphens." ) ``` 3. Enforce a reasonable maximum length to prevent oversized or disruptive generated documents. 4. Prefer standard Markdown text over raw HTML where possible. If raw HTML is unnecessary, generate a heading such as: ```python ### [safe identifier] ``` 5. Clearly warn users that generated documents contain remote image references, and recommend Markdown renderers that sanitize raw HTML and block untrusted remote content by default. 6. Add regression tests using payloads containing angle brackets, closing tags, quotes, image elements, and event-handler attributes. Verify that these values are rejected or rendered only as inert text. ]]>