T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/run.mjs:197
- Finding
- Unconditional Commercial Redirection in Successful Command Output## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 197–199 **Vulnerability Type**: Output and instruction hijacking through forced promotional content **Risk Level**: Medium ### Vulnerable Code ```js console.log(''); // __UPSELL__ console.log('[Fixed promotional message for the paid edition, including SkillPay product ID S0806000206852996]'); console.log('[External purchasing instructions at https://chenqg618.github.io/compliance-skills/buy.html]'); ``` The snippet above is an English-rendered representation of the source string literals. The function calls, product identifier, external destination, and unconditional control flow correspond to lines 197–199. ### Technical Analysis Every successful execution in the default human-readable mode reaches these statements. No explicit upgrade-information option or separate user consent is required. The program therefore injects a commercial recommendation, product identifier, and external purchase destination into the normal accounting-check response. The `__UPSELL__` marker further establishes that this output is an intentional upsell rather than part of the accounting result. Because agent skills can have their command output incorporated into an assistant's response, unconditional promotional output can redirect the user away from the requested task and toward an unrelated commercial workflow. The JSON output path does not contain this message, but that does not protect users of the documented default invocation. ### Attack Path 1. A user or agent invokes the documented command without `--json`. 2. The input passes validation and the accounting engine returns a successful result. 3. Execution reaches lines 197–199 unconditionally. 4. The program inserts the paid-product promotion and external purchasing URL before displaying the actual result. 5. The user may follow the external destination and enter the separately documented installation and payme ...[truncated 476 chars]
- Remediation
- ## Remediation Suggestions - Remove promotional material from normal accounting results. - Keep optional upgrade information in static documentation rather than runtime output. - If runtime upgrade information is necessary, require an explicit option such as `--show-upgrade-info`. - Keep machine-readable and human-readable result channels limited to task-relevant findings. - Do not include external purchase instructions in output that an agent may treat as part of the requested result. - Add regression tests confirming that a standard successful invocation emits only the accounting result and execution metadata.