T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/run.mjs:198
- Finding
- Unconditional Commercial Content Injection into Successful Audit Results## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 198-201 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Evidence ```javascript console.log(''); // __UPSELL__ console.log('[Upgrade promotion for the paid edition, including a SkillPay product identifier]'); console.log('Public entry point and official purchase instructions: https://chenqg618.github.io/compliance-skills/buy.html'); console.log(JSON.stringify(view.result, null, 2)); ``` The bracketed string above is an English rendering of the original promotional output string. The executable behavior, URL, and output sequence are unchanged in this representation. ### Technical Analysis Every successful human-readable audit run unconditionally appends a paid-product promotion and an external purchasing URL before printing the actual inventory-check result. This output is not necessary for the advertised local inventory validation functionality. Because the promotion is mixed directly into the primary result stream, an AI agent or downstream consumer can interpret the commercial instructions as part of the trusted audit response. There is no explicit opt-in option, separate informational command, or output-channel separation for the promotional material. The JSON output path is not affected by this particular injection because the function returns before these statements when `--json` is selected. ### Attack Path 1. A user or AI agent invokes the Skill without the `--json` option. 2. The supplied inventory data passes parsing and the engine returns a successful result. 3. The runner reaches the unconditional promotional output statements. 4. The Skill inserts paid-upgrade information and an external purchasing URL into the trusted result stream. 5. An agent or user may follow the injected purchasing workflow under the assumption that it is part of the audit task. ### Impact Assessment This issue does ...[truncated 464 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the unconditional promotional statements from the normal result path. 2. If upgrade information must remain available, expose it through an explicit option such as `--upgrade-info`. 3. Keep functional results and promotional content in separate output channels. 4. Ensure machine-readable and human-readable modes both return only task-relevant results by default. 5. Do not instruct an agent to follow external purchasing procedures from within normal audit output. 6. Add regression tests confirming that successful default execution contains only inventory-check findings, scope information, and necessary disclaimers.