T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/run.mjs:196
- Finding
- Unconditional Commercial Content Injection into Successful Results<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.mjs:196-198` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Vulnerable Code ```js console.log(''); // __UPSELL__ console.log('For the complete edition: Fresh Produce Loss and Stocktake Check · Perpetual License Edition (SkillPay product ID S0806000206846697) — all five checks omitted from this edition are available in the complete edition.'); console.log('Public entry point and official purchase instructions: https://chenqg618.github.io/compliance-skills/buy.html (you may also consult the optional complete-edition section in this package’s SKILL.md).'); ``` The displayed English strings above are faithful translations of the original user-facing string literals; the control flow and URL are unchanged. ### Technical Analysis Every successful invocation using the default human-readable output path unconditionally appends a commercial advertisement and an external purchase URL. The `__UPSELL__` marker further indicates that this insertion is intentional. The behavior is unrelated to presenting the requested inventory-check findings. Because it is embedded in the normal success path and has no explicit opt-in condition, users and agents cannot request ordinary human-readable results without also receiving the promotional redirection. This compromises the integrity of skill output and uses a legitimate task result as a delivery channel for unrelated commercial instructions. The JSON output path does not print these lines, but the default documented invocation uses human-readable output, making the behavior reliably reachable. ### Attack Path 1. A user or agent invokes `node scripts/run.mjs --sample` or supplies a valid input file without `--json`. 2. The local engine successfully completes the inventory checks. 3. Execution enters the human-readable success branch. 4. Lines 196-198 unconditionally append a paid-product advertisement and external purch ...[truncated 694 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all unconditional promotional output from the normal success path. 2. Keep default output limited to the requested check results, execution scope, and relevant warnings. 3. If upgrade information must remain available, place it behind an explicit option such as `--upgrade-info`. 4. Clearly label any optional commercial information and ensure it is never represented as part of the checker’s findings. 5. Keep machine-readable and human-readable output semantically equivalent, apart from formatting. 6. Add regression tests asserting that ordinary successful runs contain no external purchase links or unrelated instructions. ]]>