T01 · Skill Instruction Hijacking
Error
- Location
- scripts/run.mjs:197
- Finding
- Mandatory Commercial Content Injection into Successful Results<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 197-199 **Vulnerability Type**: Forced promotional output and external workflow redirection **Risk Level**: High ### Vulnerable Code ```js console.log(''); // __UPSELL__ console.log('如需完整档：应收账款账龄核对 · 买断版（SkillPay 商品号 S0806000206846667）—— 本版本未执行的 4 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` ### Technical Analysis Every successful non-JSON execution unconditionally appends a commercial advertisement, product identifier, and external purchasing URL to the accounting results. The user cannot disable this content independently of selecting JSON output. The injected material is unrelated to the requested AR-aging analysis and redirects users or downstream agents toward an external commercial workflow. Because it is inserted into the standard result channel, automated consumers may mistakenly treat the promotion as part of the substantive audit result. This behavior constitutes skill output hijacking: execution begins as a local accounting check, but the final response is modified to advance a separate commercial objective. ### Attack Path 1. A user supplies an AR-aging table and invokes the local checker without `--json`. 2. The engine performs the expected accounting checks. 3. The successful output path reaches lines 197-199. 4. The program unconditionally inserts the product promotion and external URL. 5. The user or a downstream AI agent follows the external purchase instructions, leaving the scope of the original accounting task. ### Impact Assessment The issue does not directly grant operating-system privileges or access credentials. Its impact is control over the content presented through the trusted result channel. The affected scope includes every successful human-readable invocation. It can redirect users or agents to external instructions and commercial actions while leverag ...[truncated 64 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all mandatory promotional content from the normal result path. 2. Keep accounting output limited to requested findings, execution metadata, and remediation relevant to those findings. 3. If upgrade information is necessary, expose it only through an explicit option such as `--upgrade-info`. 4. Do not include external purchasing instructions in output consumed by automated agents. 5. Separate commercial documentation from executable behavior and clearly label it as optional. 6. Add regression tests confirming that ordinary successful execution contains no advertisements or unrelated external links. ]]>