T08 · Insecure Dependencies
Warning
- Location
scripts/app_auth.html:7- Finding
Remote JavaScript dependency executes in a page that processes an App Key
- Content
View full analysis
``` ```javascript const appId = document.getElementById('appId').value.trim(); const appKey = document.getElementById('appKey').value.trim(); const userId = document.getElementById('userId').value.trim(); const minutes = parseInt(document.getElementById('expireMinutes').value); let nonce = document.getElementById('nonce').value.trim(); // Build the signing string const signString = appId + ":" + userId + ":" + expireTime + ":" + nonce; // Calculate HMAC-SHA256 const hmac = CryptoJS.HmacSHA256(signString, appKey); // Hex encoding const signature = hmac.toString(CryptoJS.enc.Hex); // Base64-encode the App ID const access = CryptoJS.enc.Base64.stringify(CryptoJS.enc.Utf8.parse(appId)); // Build the Authorization header const authorization = `HMAC-SHA256 signature=${signature},access=${access}`; ``` ### Technical Analysis The page loads executable JavaScript from a mutable CDN URL without Subresource Integrity. It also lacks a restrictive Content Security Policy that would constrain the behavior of the imported script. The remotely supplied JavaScript executes in the same browser context as the signature generator. Consequently, it can access the DOM fields containing the App ID, App Key, user ID, generated signature, and authorization header. Although the reviewed CryptoJS code path is used legitimately for HMAC generation, the effective code executed by the page can change after the Skill package has been reviewed. This also conflicts with the documentation statement that the HTML tool requires no server or dependency: opening the page requires retrieving executable code from an external service. ### ...[truncated 1297 chars]- Remediation
View remediation
` dependency from the credential-processing page. 2. Prefer the browser's native Web Crypto API for HMAC-SHA256 generation. 3. Alternatively, bundle a reviewed and pinned copy of CryptoJS inside the Skill package. 4. If remote loading is unavoidable: - Use an immutable, version-pinned artifact. - Add a verified `integrity` hash and `crossorigin="anonymous"`. - Enforce a restrictive Content Security Policy. - Restrict outbound connections with `connect-src 'none'` if the page does not require networking. 5. Update `SKILL.md` so its dependency and network behavior are accurately documented. 6. Perform periodic integrity review of any bundled cryptographic library. ]]>