Recognised AI widget script has no integrity attribute
ShipReady found a supported AI-widget provider script in static HTML without an integrity attribute.
Why it matters
A missing integrity attribute is a static supply-chain review signal, not a demonstration that a resource was altered.
How ShipReady detects it
What it inspects
ShipReady inspects script tags for maintained AI-widget provider host signatures and integrity attributes.
What triggers a finding
A supported provider script has no integrity attribute; findings are deduplicated by provider.
What the evidence shows
The inspected HTML contains a recognised provider script tag without an integrity attribute.
Limits of this check
ShipReady does not fetch or execute the script, verify a vendor supports SRI, or prove compromise, data access, or runtime widget behavior.
How to fix it
Review whether SRI is supportable
Confirm that the recognised widget provider publishes a stable, integrity-pinnable script before adding SRI. If it does, use the provider’s documented integrity value and any required crossorigin setting in the deployed script tag.
How to verify the change
Verify the deployed script tag
Fetch the affected page and confirm the recognised widget script has the intended non-empty integrity attribute. Independently test the provider integration after any pinning change.
Expected: The returned HTML contains the intended integrity attribute; runtime behavior still requires separate testing.