T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:25
- Finding
- Unescaped User-Controlled Content Inserted into Generated HTML<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 25–36; additional insertion points at lines 48, 58, 71, and 80 **Vulnerability Type**: HTML injection and potential cross-site scripting through unsafe template interpolation **Risk Level**: Medium ### Vulnerable Code ```markdown 将抽取并清洗后的内容代入下方的 HTML 模板中。 **DOM 删减规则：** - 如果 [核心数据] 与 [进度节点] **同时缺失**，彻底删除包含这两个模块的外部 `<div style="display: flex;">` 容器。 - 如果仅缺失其中一个，删除缺失项对应的子 `<div>`，并保持保留项的 `flex: 1` 属性以占满整行。 **HTML 输出模板（现代色彩渐变版）：** ```html <div style="background: linear-gradient(145deg, #F8FAFC 0%, #FFFFFF 100%); padding: 40px; border-radius: 16px; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif; color: #334155; max-width: 850px; margin: 20px auto; box-shadow: 0 10px 40px rgba(0,0,0,0.06); border: 1px solid rgba(255,255,255,0.8); overflow: hidden;"> <div style="background: linear-gradient(135deg, #6366F1 0%, #8B5CF6 50%, #A78BFA 100%); padding: 20px 25px; border-radius: 12px; margin-bottom: 25px; box-shadow: 0 4px 20px rgba(99,102,241,0.25);"> <h1 style="font-size: 26px; margin: 0 0 8px 0; color: #FFFFFF; font-weight: 600; letter-spacing: -0.3px;">[提取的核心主题]</h1> <p style="font-size: 14px; color: rgba(255,255,255,0.85); margin: 0; font-weight: 400;"><strong>相关方：</strong>[提取的干系人/系统] | <strong>时间：</strong>[当前日期或事件日期]</p> </div> ``` ``` Other affected interpolation sinks include: ```html <p style="font-size: 15px; line-height: 1.7; margin: 0; color: #475569; font-weight: 500;">[用 2-3 句话客观总结沟通的最终定论或当前状态]</p> <li>[量化点 1]</li> <li>[节点 1及状态]</li> [使用无序列表或带序号的列表，客观描述决策过程、技术方案或业务链路] <li><strong>[动作/风险1]：</strong>[具体描述与责任边界]</li> ``` ### Technical Analysis The skill directs the agent to extract information from user-provided communications and interpolate the extracted values directly into an HTML template. It does not require HTML entity encoding, context-aware output escaping, or sanitization with a strict allowlist. The skill's “langu ...[truncated 2256 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require context-aware HTML escaping for every value derived from user input before template interpolation. At minimum, encode `&`, `<`, `>`, `"`, and `'`. 2. State explicitly that stylistic language cleanup is not a substitute for HTML sanitization. 3. Treat extracted topics, stakeholders, dates, conclusions, metrics, milestones, process descriptions, risks, and actions as untrusted text. 4. Prefer inserting extracted values as text nodes through a trusted templating or DOM API rather than constructing raw HTML strings. 5. If limited rich-text formatting is required, process it with a maintained HTML sanitizer configured with a strict allowlist. 6. Reject or remove script elements, event-handler attributes, `javascript:` URLs, iframes, active embeds, SVG, MathML, form controls, and unsafe CSS or URL-bearing attributes. 7. Apply a restrictive Content Security Policy in the downstream renderer as defense in depth, particularly by disallowing inline scripts and restricting resource origins. 8. Add adversarial tests using closing tags, event handlers, encoded markup, malformed elements, SVG payloads, and dangerous URL schemes to verify that generated reports render only inert text. ]]>