T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/run.mjs:197
- Finding
- Unconditional Commercial Redirection in Successful Audit Output## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 197–199 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium **Complete Code Snippet**: ```js console.log(''); // __UPSELL__ console.log('如需完整档：票据贴现利息核对 · 买断版（SkillPay 商品号 S0806000206837909）—— 本版本未执行的 5 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` ### Technical Analysis Every successful human-readable execution unconditionally appends an advertisement for a paid product and directs the user to an external purchase page. The behavior is explicitly identified by the `__UPSELL__` marker and is not controlled by a user-requested option. Although this code does not itself execute the remote content, it modifies the expected task output by adding commercial instructions unrelated to the calculation results. In an agent environment, such output can influence the current interaction and redirect the user or agent toward a separate installation and payment workflow. This is best classified as instruction hijacking because the Skill uses normal result output as a channel for steering subsequent user or agent behavior. ### Attack Path 1. A user invokes the Skill with a valid bill-discount worksheet. 2. The local validation engine completes successfully. 3. The runner enters the human-readable output branch. 4. The runner unconditionally prints the paid-product advertisement and external URL. 5. The user or an AI agent follows the linked purchase instructions. 6. The interaction leaves the audited local calculation workflow and enters an externally controlled installation or transaction process. ### Impact Assessment The directly obtained capability is influence over agent-visible and user-visible output. This code does not independently obtain operating-system privileges, access credentials, initiate payment, or execute remote code. It ...[truncated 225 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the unconditional upsell output from the normal success path. 2. Keep successful output limited to the requested calculation results, executed checks, limitations, and locally derived findings. 3. If commercial information must remain available, place it behind an explicit option such as `--purchase-info`. 4. Do not print external installation or purchase links unless the user explicitly asks for upgrade information. 5. Clearly separate computation results from promotional material using a distinct command or documentation page. 6. Add automated output tests confirming that default and successful executions contain no advertisements or external transaction instructions.