T08 · Insecure Dependencies
- Location
SKILL.md:110- Finding
Unrestricted Retrieval of Unverified Third-Party Fonts
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 110
Vulnerability Type: Unverified third-party dependency retrieval
Risk Level: MediumComplete Vulnerable Snippet:
markdown Download and use whatever fonts are needed to make this a reality. Get creative by making the typography actually part of the art itself -- if the art is abstract, bring the font onto the canvas, not typeset digitally.Technical Analysis
The Skill instructs the Agent to download arbitrary fonts without restricting retrieval to trusted repositories, pinning specific versions, requiring cryptographic integrity verification, or obtaining user approval. Although the project includes font license notices under
canvas-fonts/, it does not include corresponding font binaries.This creates a supply-chain boundary in which the effective input processed during execution is not represented by the audited package. An attacker could compromise a font distribution source, manipulate search results, or host a substituted font file. The downloaded file could then be opened, rendered, converted, or embedded by local design software. Malformed font files may exploit vulnerabilities in font parsers or rendering libraries.
This finding concerns unsafe component retrieval rather than remote code retrieval and execution: the instruction requests font assets, not executable scripts. No evidence of an intentionally malicious URL or payload was found.
Attack Path
- A user invokes the Skill to generate visual artwork.
- The Agent follows the instruction to obtain additional fonts.
- The Agent chooses an arbitrary or attacker-influenced download source because no source allowlist is defined.
- The source returns a substituted, corrupted, or maliciously crafted font file.
- The Agent opens, renders, converts, or embeds the file using a local font parser or design tool.
- If the parser contains an exploitable vulnerability, the cra ...[truncated 828 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the unrestricted instruction to download “whatever fonts are needed.”
- Prefer bundling the required font binaries directly in the package with their applicable license notices.
- If downloads are necessary, define an explicit allowlist of official HTTPS repositories and exact asset URLs.
- Pin each permitted font to a specific version and publish a SHA-256 or stronger cryptographic hash.
- Verify the downloaded file against the expected hash before opening or embedding it.
- Validate the file signature, declared format, extension, and maximum size; reject archives or unexpected executable content.
- Process external fonts in a sandboxed, unprivileged renderer with minimal filesystem and network access.
- Require explicit user approval before retrieving any asset not already included in the project.
- Record the source URL, version, hash, and license of every downloaded asset for reproducibility and auditing.