T03 · Remote Payload Retrieval and Execution
Warning
- Location
assets/template.html:8- Finding
Unverified Third-Party JavaScript Executes in Generated Presentations
- Content
View full analysis
``` ### Technical Analysis The presentation template loads and executes JavaScript directly from an external CDN. The script reference has no Subresource Integrity (`integrity`) attribute, and the document does not define a restrictive Content Security Policy. Consequently, the effective executable payload is determined by the CDN response at presentation-viewing time and can change after the Skill package has been reviewed. The external font stylesheets are not executable dependencies by themselves, but they create additional third-party network requests that disclose viewer metadata such as IP address, request headers, and access time. The project documentation explicitly encourages CDN-based resources in `SKILL.md:72-74` and `references/design-spec.md:36-46`, so generated presentations are likely to retain this exposure. ### Attack Path 1. The Skill generates an HTML presentation based on `assets/template.html`. 2. A user opens the generated presentation while network access is available. 3. The browser requests `tailwind.min.js` from the external CDN. 4. An attacker who compromises the CDN resource, CDN publishing account, delivery infrastructure, or another component capable of altering the response substitutes malicious JavaScript. 5. Because no SRI hash validates the response and no restrictive CSP blocks it, the browser executes the substituted code. 6. The malicious scr ...[truncated 839 chars]- Remediation
View remediation
` policy. Limit `script-src`, `style-src`, `font-src`, `connect-src`, `img-src`, and `frame-src` to the minimum required sources. 6. Avoid allowing generated user content to create arbitrary script elements, event-handler attributes, or untrusted URLs. ]]>