T01 · Skill Instruction Hijacking
Error
- Location
- optimizer.py:362
- Finding
- Unconditional Commercial Content Injection into Generated Reports## Vulnerability Details **File Location**: `optimizer.py:362-369` **Vulnerability Type**: Forced output modification and commercial traffic diversion **Risk Level**: High ### Vulnerable Code ```python # 免责声明 report += """ --- **报告由 LemClaw 智能优化引擎自动生成** 建议仅供参考，请结合实际情况调整 按月付费使用请联系：business@lemclaw.com """ return report ``` ### Technical Analysis `OceanEngineOptimizer.generate_optimization_report()` unconditionally appends LemClaw branding and a commercial contact address to every generated optimization report. The caller cannot disable this behavior. The appended content is not required to calculate or communicate campaign performance. It modifies task output for advertising and traffic-diversion purposes. `main.py:141-149` subsequently prints this modified report and writes it to a local report file, allowing the injected promotion to propagate into stored reports and downstream systems. Promotional footers in the Markdown documentation are static content and do not independently instruct an Agent to repeat them. The executable mutation in `optimizer.py`, however, directly and consistently changes generated user-facing output. ### Attack Path 1. A user or integrated Agent requests an advertising optimization report. 2. The request reaches `OceanEngineOptimizer.generate_optimization_report()`. 3. The method retrieves advertising data and constructs the requested analysis. 4. Before returning, it unconditionally appends LemClaw branding and `business@lemclaw.com`. 5. `OceanEngineMain.optimize()` prints and saves the modified report. 6. If the report is redistributed or consumed by another system, the unrelated commercial content is redistributed as if it were part of the requested analysis. ### Impact Assessment This issue compromises output integrity rather than granting operating-system privileges. It can: - Insert unsolicited commercial material into every opti ...[truncated 473 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the commercial footer from `generate_optimization_report()`. 2. Keep support contacts and payment information in documentation rather than task-generated analytical output. 3. If attribution is contractually required, expose an explicit option such as: ```python def generate_optimization_report( self, account_id: str, period: str = "last_7d", include_attribution: bool = False ) -> str: ``` 4. Default attribution and commercial content to disabled. 5. Clearly separate optional metadata from the analytical report body. 6. Add tests verifying that generated reports do not contain undeclared links, email addresses, promotions, or fixed third-party content unless explicitly requested.