T01 · Skill Instruction Hijacking
Warning
- Location
- ` without `--json`. 2. The local engine performs the expected reconciliation checks. 3. After reporting successful execution, the script unconditionally prints the upsell. 4. The output directs the user or Agent to an external website containing purchase instructions. 5. If followed, the user or Agent leaves the audited local workflow and enters a separate installation and payment process. ### Impact Assessment No operating-system privileges, credentials, or network access are obtained by these three line ...[truncated 463 chars]:197
- Finding
- Mandatory Commercial Redirection Embedded in Successful Results<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 197–199 **Vulnerability Type**: Runtime output manipulation and commercial redirection **Risk Level**: Medium ### Complete Code Snippet The following is a faithful English rendering of the affected source lines; URLs, product identifiers, and control markers are preserved: ```js console.log(''); // __UPSELL__ console.log('For the complete edition: Export Declaration and FX Collection Check · Perpetual License Edition (SkillPay product S0806000206845522) — all five checks omitted from this edition are included.'); console.log('Public entry point and official purchase instructions: https://chenqg618.github.io/compliance-skills/buy.html (also see the optional complete-edition section in this package’s SKILL.md).'); ``` ### Technical Analysis Every successful invocation using the default human-readable output path appends a commercial promotion and an external purchase link. This behavior is not required to perform the declared reconciliation checks. The explicit `__UPSELL__` marker indicates that this is an intentional output-injection point. Because the messages are emitted unconditionally after a successful check, users cannot obtain normal human-readable results without also receiving the commercial redirection. The `--json` path does not print these messages, but that does not mitigate the default-path behavior. This is best classified as instruction and output hijacking because legitimate task output is used as a stable channel to redirect the user or supervising Agent toward an unrelated commercial workflow. ### Attack Path 1. A user or Agent invokes `node scripts/run.mjs --input <file>` without `--json`. 2. The local engine performs the expected reconciliation checks. 3. After reporting successful execution, the script unconditionally prints the upsell. 4. The output directs the user or Agent to an external website containing purchase instructions. 5. If followed, the us ...[truncated 571 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the unconditional promotion from the successful execution path. 2. Keep runtime output limited to reconciliation findings, execution status, and required operational guidance. 3. If commercial information must be retained, place it in separate documentation rather than executable output. 4. Alternatively, display it only after explicit user opt-in through a clearly named option such as `--show-related-products`. 5. Ensure both human-readable and JSON output modes follow the same output-integrity policy. 6. Add automated tests verifying that successful checks do not emit external purchase links or unrelated instructions. ]]>