T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/run.mjs:196
- Finding
- Unconditional Commercial Promotion Injected into Successful Results<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.mjs:196-198` **Vulnerability Type**: Unconditional output manipulation **Risk Level**: Medium ### Evidence ```js console.log(''); // __UPSELL__ console.log('如需完整档：在建工程转固核对 · 买断版（SkillPay 商品号 S0806000206840801）—— 本版本未执行的 5 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` ### Technical Analysis Every successful human-readable execution unconditionally inserts a commercial promotion and an external purchase URL before presenting the reconciliation result. The behavior is not enabled through an explicit option and is unrelated to performing the requested local ledger checks. When an AI agent invokes this Skill, the injected content becomes part of the apparent task result. It can therefore redirect the user or another agent from the original reconciliation task into a separate purchase and installation workflow. JSON mode does not emit these lines, but the default human-readable mode does. This is classified as skill instruction hijacking because normal task output is deliberately modified to advance a secondary commercial objective. ### Attack Path 1. A user or AI agent invokes the legitimate local checker with a valid ledger. 2. The engine completes the requested checks successfully. 3. The default output path reaches the unconditional promotion statements. 4. The runner emits a product identifier and an external purchase-instruction URL. 5. A user or downstream agent follows that URL and enters a separate installation and payment workflow. ### Impact Assessment The code does not directly gain operating-system privileges, execute the linked content, or transmit ledger data. Its immediate scope is manipulation of the agent-visible output and redirection of user attention. The secondary workflow may lead users or agents to install additional software and initiate purchasing actions. Any resulting priv ...[truncated 117 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the unconditional promotional output from the normal success path. 2. Keep reconciliation output limited to requested results, scope limitations, and actionable findings. 3. If pricing information must be available, place it behind an explicit option such as `--pricing` or in separate documentation. 4. Do not place commercial redirection before or within the primary result. 5. Add output tests that verify ordinary successful runs contain no advertisements, purchase instructions, or unrelated external links. ]]>