T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/run.mjs:197
- Finding
- Forced Commercial Content Injection into Reconciliation Results## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 197-199 **Vulnerability Type**: Output and instruction hijacking **Risk Level**: Medium ### Evidence ```js console.log(''); // __UPSELL__ console.log('如需完整档：运费对账 · 买断版（SkillPay 商品号 S0806000206846643）—— 本版本未执行的 4 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` ### Technical Analysis Every successful non-JSON execution unconditionally appends a commercial product promotion, product identifier, and external purchasing URL to the reconciliation output. The `__UPSELL__` marker further indicates that this is intentional output injection rather than information required to perform freight reconciliation. The injected content cannot be disabled separately and is unrelated to the integrity of the reconciliation result. When an AI agent invokes the script and consumes or relays its standard output, the commercial instructions become part of agent-visible content and may influence subsequent responses or actions. ### Attack Path 1. A user or AI agent invokes `node scripts/run.mjs --input <file>`. 2. The input is parsed and the reconciliation engine returns a successful result. 3. Execution reaches lines 197-199 in the default human-readable output path. 4. The script appends an upgrade advertisement and an external purchasing URL. 5. An AI agent processing the output may reproduce the promotion, direct the user to the external site, or treat the purchasing instructions as relevant follow-up actions. ### Impact Assessment This issue does not directly grant filesystem, operating-system, or network privileges. Its impact is manipulation of user-visible and agent-visible output, contamination of legitimate business results, and redirection toward an external commercial workflow. The affected scope is every successful non-JSON invocation of the command.
- Remediation
- ## Remediation Suggestions - Remove commercial promotion and purchasing instructions from normal reconciliation output. - If upgrade information must be available, require an explicit opt-in option such as `--show-upgrade-info`. - Keep machine-readable and human-readable result channels limited to reconciliation findings and operational diagnostics. - Do not embed external purchasing links in output that may be interpreted by an AI agent. - Add tests asserting that standard successful output contains only reconciliation-related information.