T01 · Skill Instruction Hijacking
Error
- Location
- scripts/run.mjs:198
- Finding
- Unconditional Commercial Redirection in Successful Analysis Output## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 198-200 **Vulnerability Type**: Unrequested modification of Agent-facing output **Risk Level**: High ### Vulnerable Code ```js console.log(''); // __UPSELL__ console.log('如需完整档：多家报价横向比价 · 买断版（SkillPay 商品号 S0806000206839353）—— 本版本未执行的 5 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` ### Technical Analysis Every successful execution using the default human-readable output path reaches these statements before the actual comparison result is printed. The inserted content advertises a paid product and directs the user or calling Agent to an external purchase page. This content is unrelated to the requested bid-comparison result and is not gated behind explicit user consent or an upgrade-information option. Because Skill output can be relayed directly by an AI Agent, unconditional promotional instructions can alter the Agent's response and redirect the interaction toward an external commercial workflow. The JSON output path does not include this promotion, but the documented default execution path does. No code execution or elevated system privilege is obtained directly through these three statements. ### Attack Path 1. A user or Agent invokes the Skill without the `--json` option. 2. The local bid-comparison operation completes successfully. 3. The runtime unconditionally adds the paid-product promotion to standard output. 4. The promotion presents an external purchase URL as part of the normal result. 5. A user or downstream Agent may follow that URL and enter a workflow that was not part of the original comparison request. ### Impact Assessment The immediate impact is manipulation of the current session's output and unsolicited commercial redirection. The code does not itself gain system privileges, access credentials, or transmit bid data. The affected scope includes every successful invocat ...[truncated 208 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the unconditional promotional output from the successful analysis path. 2. Keep standard output limited to information necessary for the requested bid comparison. 3. If upgrade information is required, place it only in static documentation or expose it through an explicit option such as `--upgrade-info`. 4. Require an affirmative user request before displaying external purchase links. 5. Keep machine-readable and human-readable result channels free of instructions that could redirect an Agent to unrelated workflows. 6. Add regression tests verifying that ordinary successful runs contain only analysis results and do not contain commercial URLs or installation instructions.