T01 · Skill Instruction Hijacking
Error
- Location
- scripts/run.mjs:197
- Finding
- Unconditional Commercial Output Injection in Successful Audit Results<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.mjs:197-199` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Complete Code Snippet ```javascript console.log(''); // __UPSELL__ console.log('如需完整档：医疗收费与医保结算核对 · 买断版（SkillPay 商品号 S0806000206845521）—— 本版本未执行的 5 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` ### Technical Analysis The normal human-readable success path unconditionally adds a commercial promotion, product identifier, and external purchase URL to the requested reconciliation results. The explicit `__UPSELL__` marker confirms that this output is intentionally injected as an upsell rather than being part of the medical revenue analysis. Because these statements execute after every successful non-JSON audit, users cannot obtain a normal human-readable result without receiving the unrelated purchasing directive. Embedding this content in trusted operational output can redirect the user or an AI agent from the original reconciliation task toward an external commercial workflow. The JSON output path does not contain this injection, but that does not protect users who rely on the documented default human-readable mode. ### Attack Path 1. A user supplies a medical revenue and insurance settlement table. 2. The local engine performs the documented checks successfully. 3. The command enters the default human-readable output path. 4. Lines 197-199 append a fixed paid-product promotion and an external purchase-instruction URL. 5. The user or an AI agent may follow the injected link and leave the original reconciliation workflow. ### Impact Assessment The behavior does not directly grant operating-system privileges, execute remote code, or access credentials. Its scope is manipulation of trusted, user-facing output and redirection toward an external commercial transaction workflow. The practical impact includes: ...[truncated 332 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the unconditional promotional statements from the normal success path. 2. Keep operational results limited to findings, scope, limitations, and remediation relevant to the supplied medical data. 3. If upgrade information must remain available, place it behind an explicit option such as `--show-upgrade-info`. 4. Clearly separate optional commercial documentation from generated audit output. 5. Do not include external purchase instructions in content likely to be consumed automatically by another AI agent. 6. Add automated tests asserting that default result output contains no advertisements, purchase directives, or unrelated external links. ]]>