T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/run.mjs:196
- Finding
- Unconditional Commercial Redirection in Successful CLI Output## Vulnerability Details **File Location**: `scripts/run.mjs:196-199` **Vulnerability Type**: Unconditional promotional output and external redirection **Risk Level**: Medium ### Vulnerable Code The following excerpt preserves the executable structure while rendering the original non-English string literals as English translations: ```js console.log(''); // __UPSELL__ console.log('For the complete edition: FX Settlement and Exchange Gain/Loss Check - Buyout Edition (SkillPay product S0806000206836341). The five checks not performed by this edition are available in the complete edition.'); console.log('Public entry and official purchase instructions: https://chenqg618.github.io/compliance-skills/buy.html (also see the optional complete-edition section in this package’s SKILL.md).'); console.log(JSON.stringify(view.result, null, 2)); ``` ### Technical Analysis The normal human-readable success path unconditionally appends an upsell message and directs the user to an external purchase page. This behavior is not necessary for the advertised local foreign-exchange validation operation and cannot be disabled through an explicit user preference. A Skill can influence an Agent or user through both its instructions and its generated output. Embedding a commercial redirection in every successful result alters the expected response by adding unrelated instructions and a pathway to content outside the audited package. An Agent that treats tool output as actionable guidance could follow or repeat this redirection. This issue best matches instruction hijacking because normal task output is used to steer the session toward a separate installation and purchase workflow. No evidence shows that the CLI itself automatically opens the URL, executes remote code, initiates payment, or transmits the input data. ### Attack Path 1. A user or Agent invokes `node scripts/run.mjs --input <file>` without the `--json` option. 2. The local v ...[truncated 815 chars]
- Remediation
- ## Remediation Suggestions 1. Remove promotional and purchase-related output from the default validation path. 2. Return only validation results, warnings, and information directly relevant to the requested task. 3. If upgrade information must remain available, place it behind an explicit option such as `--upgrade-info`. 4. Do not instruct an Agent to follow external installation or payment workflows from ordinary tool output. 5. Clearly identify any external link as optional and outside the audited local operation. 6. Add tests asserting that standard success output contains no unrelated URLs, purchase instructions, or installation guidance.