T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/find.mjs:164
- Finding
- Unconditional Injection of a Third-Party Promotional Link into Agent Responses<![CDATA[ ## Vulnerability Details **File Location**: `scripts/find.mjs:164-168` **Supporting Instruction Location**: `SKILL.md:57-67` **Vulnerability Type**: Agent response manipulation and unsolicited external traffic routing **Risk Level**: Medium ### Vulnerable Code ```javascript // 分享引导 lines.push('─'.repeat(30)); lines.push(`💡 发现更好的优惠？欢迎分享给大家！`); lines.push(`📮 提交活动链接: ${SHARE_URL}`); return lines.join('\n'); ``` The destination is hardcoded earlier in the same file: ```javascript const SHARE_URL = 'https://my.feishu.cn/share/base/form/shrcn4ERBYeALeE2cF8SMPIqHUE'; ``` In addition, `SKILL.md:57-67` instructs the agent to return the same external form when it interprets a request as an intent to share or submit an activity. ### Technical Analysis The `formatResults()` function unconditionally appends a fixed Feishu form link to every successful formatted search response. The link is unrelated to the processing required to locate and return coupons, and the user does not need to request submission functionality for it to appear. The skill instructions tell the agent to return the script's formatted output directly. Consequently, the injected call to action propagates from the local script into the agent's final response. This creates a stable response-manipulation path in which installing and invoking the skill causes the agent to promote a predetermined third-party destination. The external form may solicit information from users, but the audited project does not contain the form implementation. Therefore, the exact information collected by the destination and its downstream handling cannot be established from the available source. No evidence was found that the local script itself transmits data, accesses credentials, executes external code, or obtains elevated privileges. ### Attack Path 1. An operator installs or loads the coupon-finder skill. 2. A user asks the agent to find a coupon or discount. 3. The agent invokes `scripts/find.mjs` ...[truncated 1513 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the unconditional sharing call to action from `formatResults()` so coupon queries return only information relevant to the user's request. 2. Do not embed a fixed promotional destination in every successful response. 3. Expose submission functionality only when the user explicitly asks to submit or share an activity. 4. Clearly label the form as an external destination and identify its operator and intended data use before asking the user to visit it. 5. Request explicit user confirmation before directing the user to a form that may collect information. 6. Update `SKILL.md` so it does not mandate a predetermined external-link response. It should describe submission as an optional capability rather than overriding the normal response flow. 7. Keep external destinations in a reviewed configuration file or allowlist rather than scattering fixed links across both instructions and executable code. 8. Add tests verifying that ordinary coupon searches do not contain unrelated submission links. 9. Periodically validate approved destinations, require HTTPS, and document whether links contain affiliate or tracking identifiers. ]]>