T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:28
- Finding
- Unsanitized user-controlled values in generated public HTML<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:28-33, 43-46` **Vulnerability Type**: Stored HTML/script injection through unsafe template substitution **Risk Level**: Medium ### Vulnerable Code ```markdown 1. **Collect info**: name, description, avatar URL (optional), links (e.g. GitHub, blog). 2. **Generate HTML**: Use `index.html.example` as template; keep under 512KB for server upload. 3. **Register** to chosen target (see below). ``` ```html <img class="avatar" src="{{avatar_url}}" alt="avatar"> <h1>{{name}}</h1> <p class="desc">{{description}}</p> <p><a href="{{link}}">{{link_text}}</a></p> ``` ### Technical Analysis The Skill directs the Agent to collect user-controlled identity fields and substitute them into an HTML template, but it does not require context-sensitive escaping or URL validation. The `name`, `description`, and `link_text` values are inserted into HTML text contexts. An attacker can supply closing tags and additional markup, potentially including executable script content. The `avatar_url` and `link` values are inserted into quoted attribute contexts without escaping. An attacker may therefore attempt to terminate an attribute and introduce new attributes or elements. The `link` field may also contain an unsafe URI scheme such as `javascript:` unless the generated output validates schemes. Because the workflow subsequently publishes the generated document to the OpenWechat relay or a public static-hosting provider, successful injection becomes stored in a publicly accessible page rather than remaining limited to the generation session. ### Attack Path 1. An attacker provides a crafted value for an identity-card field such as the name, description, avatar URL, link text, or link destination. 2. The Agent follows the documented workflow and substitutes that value directly into the HTML template. 3. No required escaping, sanitization, or URL-scheme allowlist prevents the supplied value from altering the resulting do ...[truncated 1092 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Apply context-aware HTML escaping to every user-controlled value before template substitution: - Escape `&`, `<`, and `>` in text nodes. - Additionally escape quotation marks in attribute values. - Use a maintained templating system with automatic escaping rather than manual string replacement. 2. Parse and validate `avatar_url` and `link` before placing them into the document: - Allow only explicitly supported schemes, preferably `https:`. - Optionally allow `http:` only when necessary. - Reject `javascript:`, `data:`, `vbscript:`, malformed URLs, control characters, and scheme-obfuscation attempts. - Consider restricting avatar sources to trusted HTTPS hosts or proxying images through a controlled service. 3. Do not permit arbitrary HTML in the name, description, or link-text fields. If formatted descriptions are required, process them with a well-maintained HTML sanitizer using a minimal allowlist of elements and attributes. 4. Add validation limits for each field, including maximum lengths and expected character formats. 5. Inspect or sanitize the complete generated document before publication. Consider enforcing a restrictive Content Security Policy, for example by disallowing inline scripts and limiting image, navigation, and connection destinations. 6. Add security tests covering closing-tag injection, quote termination, event-handler attributes, unsafe URI schemes, encoded payloads, and mixed-case or whitespace-obfuscated schemes. ]]>