h5p-type-scaffold
Fail
Audited by Gen Agent Trust Hub on Feb 27, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/scaffold.shscript is vulnerable to arbitrary code execution through Python code injection. It utilizes an unquoted Bash heredoc (<<PY) to generate an internal Python script, which causes the shell to expand variables such as$TITLE,$DESCRIPTION, and$AUTHORdirectly into the Python source code. A malicious user or agent can provide input that escapes the Python string literals to execute arbitrary commands.\n - Evidence: The `python
- <<PY
block inscripts/scaffold.sh` performs direct shell variable expansion into the Python dictionary definition without sanitization.\n- [EXTERNAL_DOWNLOADS]: The skill templates and build scripts reference and download code from external, non-verified sources.\n - Evidence: The
package.jsonfiles inassets/templates/depend ongithub:otacke/eslint-config-snordian-h5p, which is an external personal repository.\n - Evidence: The
scripts/h5p-dev.shscript usesh5p setupto fetch remote H5P libraries from the community registry.\n- [REMOTE_CODE_EXECUTION]: The scaffolded H5P content type code includes a Cross-Site Scripting (XSS) vulnerability in its core sanitization logic.\n - Evidence: In
assets/templates/snordian/src/scripts/services/dictionary.js, thesanitizemethod decodes HTML entities and then assigns the result to an element'sinnerHTML. This pattern allows embedded scripts in translation strings to execute before the tags are stripped by subsequent property access.
Recommendations
- AI detected serious security threats
Audit Metadata