T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:237- Finding
Network-Controlled API Responses Are Inserted into Executable HTML Without Safe Escaping
- Content
View full analysis
var chart = echarts.init(document.getElementById('chart')); var option = {{ECHARTS_OPTION_JSON}}; chart.setOption(option); window.addEventListener('resize', function() { chart.resize(); }); ``` The associated instruction states: ```text Replace `{{ECHARTS_OPTION_JSON}}` with the `echarts_option` value from the API response (the JSON object, not stringified). Save as a `.html` file and open: ``` Word-cloud response rendering: ```html ``` The associated instruction states: ```text Replace `{{WORDCLOUD_DATA_JSON}}` with the `data` array from the API response. ``` ### Technical Analysis The Skill directs the agent to insert values returned by a remote API directly into an inline JavaScript block. Although valid JSON is generally valid JavaScript, JSON string escaping does not inherently make a value safe for embedding inside an HTML `script` element. For example, a string property containing a sequence such as `` can terminate the HTML script element regardless of its JavaScript string context. Additional attacker-controlled ...[truncated 2184 chars]- Remediation
View remediation
SAFE_ESCAPED_JSON ``` 5. Alternatively, construct the document through DOM APIs and assign data through JavaScript variables after parsing a separately stored JSON file. 6. Add a restrictive Content Security Policy that blocks unexpected scripts and network destinations. If inline code is necessary, use a nonce or hash rather than allowing all inline scripts. 7. Treat all API response fields as untrusted, including chart titles, labels, series names, keyword values, image URLs, and error messages. 8. Add security tests using values containing ``, HTML tags, event handlers, quotes, backslashes, and Unicode line separators. ]]>