T08 · Insecure Dependencies
Warning
- Location
SKILL.md:140- Finding
Unverified Third-Party JavaScript Is Mandated for Generated Posters
- Content
View full analysis
``` ``` `examples/tech-summit-poster.html:7-8`: ```html ``` ### Technical Analysis The skill explicitly requires every generated poster to load and execute `html2canvas` from a third-party CDN. The URL pins version `1.4.1` and uses HTTPS, but the script element does not contain a Subresource Integrity (`integrity`) value or a corresponding `crossorigin` policy. Consequently, the browser trusts and executes whatever JavaScript is returned by the remote endpoint at page-load time. This creates a remote-code supply-chain boundary that is not represented by the reviewed package contents. If the CDN, its publishing account, or the hosted asset were compromised, the effective JavaScript payload could change after this skill had been audited. The example poster reproduces the mandated unsafe pattern. The external Google Fonts stylesheet also causes a third-party network request, but the confirmed executable-code risk is specifically the unverified `html2canvas` script. ### Attack Path 1. A user invokes the skill to generate an HTML poster. 2. Following the mandatory instructions in `SKILL.md`, the generated document includes the remote `html2canvas` script. 3. The user opens the generated HTML document in a browser. 4. The browser requests the JavaScript from `cdnjs.cloudflare.com`. 5. An attacker who has ...[truncated 1197 chars]- Remediation
View remediation