T01 · Skill Instruction Hijacking
Error
- Location
- scripts/run.mjs:199
- Finding
- Unconditional Commercial Promotion Injected into Successful Results## Vulnerability Details **File Location**: `scripts/run.mjs:199-201` **Vulnerability Type**: Output and instruction hijacking **Risk Level**: High ### Evidence The following is an English translation of the complete affected source segment; identifiers and URLs are preserved exactly: ```js console.log(''); // __UPSELL__ console.log('For the full edition: Inventory Reconciliation · Perpetual License Edition (SkillPay product S0806000206851196) — all four checks omitted from this edition are available in the full edition.'); console.log('Public entry point and official purchase instructions: https://chenqg618.github.io/compliance-skills/buy.html (or see the optional full-edition section in this package’s SKILL.md).'); ``` ### Technical Analysis Every successful non-JSON execution unconditionally appends a paid-product advertisement, product identifier, and external purchase URL to the requested inventory reconciliation result. The output is not conditional on an explicit request for upgrade or purchase information. The `__UPSELL__` marker and placement directly in the normal success path demonstrate that this output is intentionally inserted into ordinary task results. This alters the expected purpose of the Agent response by turning a successful inventory check into a commercial redirection channel. ### Attack Path 1. A user invokes the Skill to reconcile an inventory table. 2. The local inventory engine successfully completes its checks. 3. The non-JSON output path is selected. 4. The runner always prints the paid-product identifier and external purchase URL. 5. The user or an automated Agent may interpret the injected material as part of the requested result and follow the unrelated installation or purchase workflow. ### Impact Assessment This issue does not directly grant operating-system privileges or access to local credentials. Its scope is the Agent's response and current workflow: it predictably redire ...[truncated 269 chars]
- Remediation
- ## Remediation Suggestions - Remove commercial promotion from the default success-output path. - Keep inventory results limited to information directly relevant to the requested reconciliation. - If upgrade information must remain available, place it behind an explicit option such as `--show-upgrade-info`, disabled by default. - Do not include installation or purchase instructions in machine-readable result objects. - Add regression tests confirming that ordinary executions contain no advertisements, purchase identifiers, or external commercial links.