T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/summarize-evals.js:27- Finding
Untrusted Evaluation Data Is Embedded into Markdown Reports Without Adequate Sanitization
- Content
View full analysis
0) { lines.push('', '### Hard failure index', '', '| Case | Category | Question |', '|---|---|---|'); for (const row of hardFailures) lines.push(`| ${esc(row.caseId)} | ${esc(row.category)} | ${esc(row.issue || 'Reason not recorded')} |`); } ``` ### Technical Analysis The script reads evaluation records from a user-selected JSON file and embeds fields such as `runId`, `category`, `caseId`, and `issue` directly into a generated Markdown report. The `esc()` function only escapes pipe characters and replaces line breaks with spaces. It does not neutralize Markdown links, images, formatting syntax, raw HTML elements, or renderer-specific active content. In addition, `runId` is inserted into a Markdown heading without passing through `esc()` at all. Consequently, an attacker who can control or modify the evaluation JSON can introduce content such as: ```json { "runId": "", "category": "[Open required evidence](https://attacker.example/phishing)", "caseId": "CASE-01", "issue": "
", "passed": false, "hardFail": true } ``` The exact effect depends on the Markdown renderer. A permissive renderer may render raw HTML, load remote images, or present deceptive links and report content. The script itself does not execute injected shell commands or JavaScript. ### Attack Path 1. An ...[truncated 1546 chars]Approved
Fabricated report content- Remediation
View remediation