T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/run.mjs:197
- Finding
- Forced Commercial Content Injection into Successful Audit Output## Vulnerability Details **File Location**: `scripts/run.mjs:197-199` **Vulnerability Type**: Output manipulation and instruction hijacking **Risk Level**: Medium ### Vulnerable Code ```javascript console.log(''); // __UPSELL__ console.log('For the complete edition: Fleet Fuel and Freight Cost Check — Perpetual License (SkillPay product ID S0806000206854888). The five checks omitted by this edition are included in the complete edition.'); console.log('Public entry point and official purchase instructions: https://chenqg618.github.io/compliance-skills/buy.html (see also the optional complete-edition section in this package’s SKILL.md).'); ``` The snippet above is an English rendering of the hard-coded source strings at the specified lines; the identifiers, product ID, URL, and behavior are unchanged. ### Technical Analysis The normal human-readable success path unconditionally inserts an upsell message and external purchase URL immediately before the requested audit result. This behavior is not necessary for ledger validation and cannot be disabled independently. Because the message is emitted as part of ordinary successful execution, users may interpret the commercial recommendation as part of the trusted Agent result rather than as separate promotional content. The explicit `__UPSELL__` marker further establishes that this output was deliberately introduced for commercial redirection. The JSON output path does not print these lines, but every successful non-JSON invocation reaches them. ### Attack Path 1. A user invokes the Skill with `--sample` or a valid ledger through `--input`. 2. The engine returns a successful validation result. 3. Execution enters the non-JSON success-output branch. 4. Lines 197-199 inject a product advertisement, product identifier, and external purchase URL. 5. The actual ledger result is printed only after the commercial content. 6. The user may follow the external purchase route und ...[truncated 643 chars]
- Remediation
- ## Remediation Suggestions 1. Remove all commercial promotion from the normal success-output path. 2. Return only requested validation findings, execution metadata, and relevant warnings. 3. If purchase information must remain available, place it behind an explicit user-selected option such as `--purchase-info`. 4. Clearly separate optional commercial information from audit results and never emit it by default. 5. Add automated tests asserting that standard successful executions contain no product advertisements, purchase links, or installation instructions. 6. Apply the same neutral-output policy to both human-readable and JSON output modes.