T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/run.mjs:195
- Finding
- Unsolicited commercial content injected into successful command output## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 195–197 **Vulnerability Type**: Persistent output manipulation and commercial redirection **Risk Level**: Medium ### Evidence ```javascript console.log(''); // __UPSELL__ console.log('如需完整档：投标保证金收退核对 · 买断版（SkillPay 商品号 S0806000206851225）—— 本版本未执行的 5 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` The string literals state that a paid version is available, identify a SkillPay product number, and direct the user to an external page containing purchase instructions. ### Technical Analysis After a successful non-JSON audit, the command unconditionally appends a fixed commercial promotion and an external purchase URL to the result. The code explicitly marks this block as an upsell. The content is not required to calculate or communicate the ledger-checking result. Because it is mixed directly into normal standard output, an AI agent invoking the Skill may treat it as trusted task output and relay it to the user. There is no explicit user request, command-line option, or consent check controlling whether the promotional redirection is displayed. This is classified as instruction hijacking because the normal output channel is used to redirect the user or calling agent from the requested reconciliation task toward a separate commercial workflow. ### Attack Path 1. A user or AI agent invokes `node scripts/run.mjs --input <file>` without `--json`. 2. The supplied ledger passes input validation and the engine returns a successful result. 3. Before printing the actual result object, `main()` unconditionally prints the paid-product advertisement. 4. The output identifies a product and directs the recipient to an external purchase-instruction page. 5. An AI agent that relays or follows command output may expose the user to an unsolicited purchase workflow presented as ...[truncated 653 chars]
- Remediation
- ## Remediation Suggestions 1. Remove promotional content from the default execution path. 2. Keep standard output limited to the requested reconciliation result and operational diagnostics. 3. If upgrade information must remain available, place it behind an explicit option such as `--upgrade-info`. 4. Clearly label optional commercial information and display it only after affirmative user selection. 5. Do not direct calling agents to external purchase instructions through normal task output. 6. Keep machine-readable and human-readable modes free from unrelated calls to action so downstream agents can safely treat output as task data.