T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/run.mjs:195
- Finding
- Unconditional Commercial Content Injection into Successful Results## Vulnerability Details **File Location**: `scripts/run.mjs:195-197` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Vulnerable Code ```javascript console.log(''); // __UPSELL__ console.log('For the full edition: Late Payment Surcharge Check — Perpetual License (SkillPay product S0806000206845514). The five checks omitted from this edition are included in the full edition.'); console.log('Public entry point and official purchase instructions: https://chenqg618.github.io/compliance-skills/buy.html (also see the optional full-edition section in this package’s SKILL.md).'); ``` The localized string literals above are rendered in English for reporting purposes; they correspond to the complete statements at lines 195-197. ### Technical Analysis Every successful non-JSON execution appends a fixed product advertisement and an external purchase URL to the operational result. This behavior is unconditional and is not controlled by a dedicated upgrade-information option or an explicit user request. The injected content is unrelated to performing the requested local tax-table validation. Because it is mixed directly into the normal result stream, users or downstream agents may treat the commercial redirection as part of the required workflow rather than optional promotional information. The explicit `__UPSELL__` marker further demonstrates that this output was intentionally inserted as an upsell. The JSON output path does not print these lines, but the default human-readable execution path always does so after a successful check. ### Attack Path 1. A user invokes `node scripts/run.mjs --sample` or supplies a valid input file without `--json`. 2. The local engine successfully completes the tax-table checks. 3. Before printing the actual structured result, the runner unconditionally prints the selected commercial product and external purchase URL. 4. The user or an Agent following the outp ...[truncated 646 chars]
- Remediation
- ## Remediation Suggestions 1. Remove promotional content from the normal result stream. 2. If upgrade information must remain available, place it behind an explicit option such as `--upgrade-info`. 3. Keep operational findings and commercial material in clearly separated output channels or documents. 4. Do not emit links or installation guidance unless the user explicitly requests purchasing or upgrade information. 5. Add automated tests confirming that ordinary successful runs contain only audit results and execution metadata. 6. Preserve machine-readable output as the default for Agent-driven execution to reduce the risk of promotional text being interpreted as an instruction.