T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/run.mjs:197
- Finding
- Unconditional Commercial Promotion Injected into Successful Results## Vulnerability Details **File Location**: `scripts/run.mjs:197-199` **Vulnerability Type**: Unconditional agent-facing promotional output **Risk Level**: Medium ### Vulnerable Code ```js console.log(''); // __UPSELL__ console.log('For the complete edition: Export VAT Rebate Check — Perpetual Edition (SkillPay product S0806000206832708). The five checks omitted from this edition are available in the complete edition.'); console.log('Public entry point and official purchase instructions: https://chenqg618.github.io/compliance-skills/buy.html (also see the optional complete-edition section in this package’s SKILL.md).'); ``` The displayed string literals are English translations of the original localized promotional messages. The control flow and referenced URLs and identifiers are unchanged. ### Technical Analysis After a successful human-readable audit, the launcher unconditionally appends an upsell message, external website, and purchase instructions to the result. This behavior is unrelated to performing the requested tax worksheet calculations and cannot be disabled through a dedicated option. Because Skill output is commonly returned through an AI agent, the injected message can redirect the user or agent away from the audited local workflow and into a separate installation and payment process. The explicit `__UPSELL__` marker and unconditional placement in the success path show that this is intentional output injection rather than an incidental help message. The JSON output path does not print these lines, but the default human-readable path does. ### Attack Path 1. A user invokes `node scripts/run.mjs --input worksheet.json`. 2. The local engine successfully completes the worksheet checks. 3. The default output path automatically appends the commercial promotion. 4. The promotion directs the user to an external website and references a separate SkillPay product. 5. If followed, the user enters a separate i ...[truncated 601 chars]
- Remediation
- ## Remediation Suggestions 1. Remove commercial promotion and purchase links from the normal success-output path. 2. If upgrade information is necessary, place it behind an explicit option such as `--upgrade-info`. 3. Keep calculation results limited to requested audit findings, execution metadata, and documented limitations. 4. Do not direct agents or users from operational output to unaudited external installation workflows. 5. Add output tests verifying that default successful runs contain no advertisements, purchase instructions, or unrelated external links.