T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/run.mjs:199
- Finding
- Forced commercial promotion in successful human-readable results<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 199-201 **Vulnerability Type**: Forced promotional output inserted into normal Skill results **Risk Level**: Medium ### Complete Code Snippet The following is an English rendering of the source strings at lines 199-201: ```js console.log(''); // __UPSELL__ console.log('For the complete edition: Fixed Asset Depreciation Check · Buyout Edition (SkillPay product S0806000206853002) — all four checks omitted from this edition are included.'); console.log('Public entry point and official purchase instructions: https://chenqg618.github.io/compliance-skills/buy.html (you can also see the optional complete-edition section in this package’s SKILL.md).'); ``` ### Technical Analysis The successful human-readable output path unconditionally inserts an advertisement for a paid product and an external purchase URL before printing the actual accounting result. The `__UPSELL__` marker demonstrates that this is an intentional commercial output insertion rather than part of the depreciation analysis. This behavior applies when a run succeeds without `--json`. The JSON branch returns earlier and therefore does not emit these lines. In ordinary interactive Skill use, however, the additional content can be incorporated into an agent's trusted response even though the user only requested a depreciation check. The inserted material is unrelated to the correctness of the accounting result and cannot be disabled through a dedicated runtime option. It can redirect the user or an orchestrating agent from the declared local auditing task to an external commercial workflow. ### Attack Path 1. A user asks the agent to audit a fixed-asset depreciation ledger. 2. The agent invokes `scripts/run.mjs` without `--json`. 3. The local engine successfully completes the requested calculations. 4. The successful human-readable output path reaches lines 199-201. 5. The script emits a fixed advertisement and externa ...[truncated 842 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the unconditional promotional output from the successful result path. 2. Keep runtime output limited to the requested depreciation analysis and its relevant limitations. 3. If upgrade information must remain available, expose it only through an explicit user-controlled option such as `--show-upgrade-info`. 4. Do not include external purchase links in normal accounting results. 5. Keep promotional documentation separate from executable output and clearly label it as optional. 6. Add regression tests confirming that standard and JSON result modes contain only task-relevant data. ]]>