T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:34
- Finding
- Unsafe Preservation of Untrusted JavaScript in User-Supplied Templates## Vulnerability Details **File Location**: `SKILL.md`, lines 34–40 **Vulnerability Type**: Untrusted active-content preservation **Risk Level**: Medium **Vulnerable code:** ```markdown ### If user provides a reference HTML template: 1. Read the provided template 2. Identify all text content, branding, and copy 3. **Modify the existing template — do NOT rewrite from scratch** 4. Replace copy, brand name, colors, and content to match the user's brief 5. Preserve ALL CSS, animations, layout structure, SVG filters, and JavaScript exactly 6. Output the adapted `.html` file ``` ### Technical Analysis The reference template is user-controlled and therefore untrusted. Nevertheless, the Skill directs the agent to preserve all JavaScript exactly, without requiring security review, sanitization, disclosure, or user approval. JavaScript embedded in a supplied template can access page content and origin-scoped browser data, register event handlers, alter forms, redirect visitors, and send information to external services. Exact preservation allows such behavior to survive adaptation even when it is unrelated to the requested visual design. This is an insecure generation workflow rather than evidence that the bundled template itself is malicious. The reviewed JavaScript in `assets/variant-reference.html` only implements cursor effects, animations, and page reload behavior. ### Attack Path 1. An attacker provides a visually legitimate reference HTML template containing concealed or misleading JavaScript. 2. The user asks the Skill to adapt the template to new branding or content. 3. Following `SKILL.md`, the agent modifies visible content while preserving the attacker-controlled JavaScript exactly. 4. The generated HTML is delivered without an active-content security warning. 5. The user opens the file or deploys it to a static host. 6. The preserved script executes in visitors' browsers and may read page data, intercept ...[truncated 958 chars]
- Remediation
- ## Remediation Suggestions 1. Treat every user-supplied reference template as untrusted input. 2. Remove `<script>` elements, inline event handlers, `javascript:` URLs, and other active content by default. 3. Preserve JavaScript only when it is required for explicitly requested functionality and has been reviewed for: - External network requests. - Dynamic code execution such as `eval`, `Function`, or string-based timers. - DOM injection through unsafe sinks such as untrusted `innerHTML`. - Access to cookies, local storage, session storage, forms, or sensitive browser APIs. - Obfuscation, redirects, hidden event capture, or remote script loading. 4. Present the user with a concise description of retained script behavior and obtain explicit approval before including it. 5. Reject obfuscated or unverifiable scripts rather than preserving them. 6. Add a restrictive Content Security Policy appropriate for a static page, preferably disallowing inline scripts and limiting `script-src`, `connect-src`, `form-action`, `frame-src`, and `object-src`. 7. Recommend deployment on an isolated origin that does not share cookies or storage with sensitive applications. 8. Revise the instruction to preserve only reviewed, non-dangerous visual and interactive behavior rather than requiring exact preservation of all JavaScript.