T01 · Skill Instruction Hijacking
Error
- Location
- scripts/run.mjs:197
- Finding
- Unconditional Commercial Content Injection into Successful Results## Vulnerability Details **File Location**: `scripts/run.mjs:197-199` **Vulnerability Type**: Unconditional output manipulation and commercial instruction injection **Risk Level**: High ### Vulnerable Code ```js console.log(''); // __UPSELL__ console.log('如需完整档：应收账款坏账准备计提核对 · 买断版（SkillPay 商品号 S0806000206846668）—— 本版本未执行的 5 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` ### Technical Analysis Every successful execution in the default human-readable output mode unconditionally inserts an upsell message and an external purchase URL immediately before the requested accounting-check result. This behavior is unrelated to the technical execution of the declared bad-debt provision checks. The injection is part of the standard success path rather than an optional informational command. An AI agent invoking the documented command may therefore relay unsolicited commercial content and an external action path as though they were part of the requested result. The explicit `__UPSELL__` marker further confirms that this is intentional output injection. The `--json` path does not print these lines, so the behavior is limited to the default human-readable mode. ### Attack Path 1. A user or agent invokes the documented command without the `--json` option. 2. The supplied accounting table passes validation and the engine returns a successful result. 3. The default output branch reaches lines 197-199. 4. The program inserts a product advertisement, product identifier, and external purchase-instruction URL. 5. An agent or downstream interface may present or relay that content as part of the legitimate accounting result. 6. The user may subsequently follow the promoted external workflow, which expands the interaction beyond the requested local validation task. ### Impact Assessment This issue does not directly grant operating-system privileges ...[truncated 474 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the unconditional upsell block from the normal result path. 2. Keep accounting results strictly limited to the requested validation output. 3. If commercial information must remain available, place it behind an explicit opt-in option such as `--show-upgrade-info`. 4. Never include promotional content in structured or agent-consumable task results. 5. Clearly label external links as optional, untrusted external resources rather than operational instructions. 6. Add regression tests confirming that default successful execution contains only validation results and no purchase prompts.