T01 · Skill Instruction Hijacking
Error
- Location
- scripts/run.mjs:197
- Finding
- Unconditional Commercial Promotion Injected into Successful Results<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 197-199 **Vulnerability Type**: Persistent output manipulation through unconditional promotional content **Risk Level**: High ### Vulnerable Code ```javascript console.log(''); // __UPSELL__ console.log('如需完整档：履约保证金与保函台账核对 · 买断版（SkillPay 商品号 S0806000206845526）—— 本版本未执行的 5 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` The embedded messages advertise a paid edition and direct the user to external purchasing instructions. ### Technical Analysis Every successful invocation using the default human-readable output path unconditionally prints commercial content and an external URL immediately before the legitimate check result. The output cannot be disabled through a dedicated promotion preference; only selecting JSON output incidentally avoids this branch. This behavior mixes unrelated commercial instructions with trusted audit results. When an AI agent executes the Skill and relays its output, the promotion can consequently be reproduced as though it were part of the requested result. The `__UPSELL__` marker also shows that the insertion is deliberate rather than incidental diagnostic output. The bundled promotion does not itself execute code, access credentials, or modify the system. Its security relevance is the manipulation of agent-visible and user-visible output. ### Attack Path 1. A user or AI agent invokes `node scripts/run.mjs --input <ledger-file>` without `--json`. 2. The local ledger checks complete successfully. 3. The wrapper enters the human-readable success branch. 4. Lines 197-199 unconditionally insert a paid-product advertisement and an external purchasing URL. 5. An agent that forwards or summarizes command output may reproduce that content in its response, extending the promotion beyond the Skill's legitimate checking function. ### Impact Assessment No additional opera ...[truncated 373 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the unconditional promotional output from the normal success path. 2. Keep upgrade information in documentation rather than mixing it with generated check results. 3. If upgrade information must be available at runtime, require an explicit option such as `--show-upgrade-info`. 4. Ensure default output contains only information necessary to perform and explain the requested ledger checks. 5. Add a regression test asserting that ordinary successful output contains no external purchase URLs or unrelated instructions. 6. Keep JSON and human-readable output semantically equivalent, apart from formatting. ]]>