T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_leaderboard.py:115- Finding
Stored HTML Injection and Cross-Site Scripting in Generated Leaderboards
- Content
View full analysis
Skill Leaderboard | {args.title}") ``` ```python html.append(f"{args.title}
") ``` ```python strengths = ", ".join(card.get("strengths", [])[:2]) if card.get("strengths") else "-" weaknesses = ", ".join(card.get("weaknesses", [])[:2]) if card.get("weaknesses") else "-" html.append(" ") html.append(f" {i}") html.append(f" {card.get('name', 'Unknown')}") html.append(f" {card.get('slug', 'N/A')}") html.append(f" {score}/10") html.append(f" {card.get('quality', 0)}/5") html.append(f" {card.get('delta', 0)}/3") html.append(f" {card.get('efficiency', 0)}/2") html.append(f" {rec}") html.append(f" {card.get('eval_date', 'N/A')}") html.append(f"👍 {strengths}👎 {weaknesses}") html.append(" ") ``` ### Technical Analysis The leaderboard generator reads metadata, strengths, and weaknesses from Skill Card Markdown files and interpolates those values directly into an HTML document. The user-provided `--title` argument is handled in the same way. None of these values are HTML-escaped. Because HTML metacharacters remain intact, an attacker-controlled value can break out of its intended text context and create executable markup. For example, a skill name containing an image element with an event handler would be written into the resulting leaderboard as active HTML rather than displayed as text. This is a stored injection issue because the payload can first be placed in a ...[truncated 1577 chars]- Remediation
View remediation