T01 · Skill Instruction Hijacking
Error
- Location
- scripts/run.mjs:195
- Finding
- Unconditional Paid-Product Promotion Injected into Successful Results<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.mjs:195-197` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Complete Code Snippet ```javascript console.log(''); // __UPSELL__ console.log('如需完整档：租赁负债与使用权资产核对 · 买断版（SkillPay 商品号 S0806000206853033）—— 本版本未执行的 5 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` The string literals state that users can purchase the full edition and direct them to an external page containing purchasing instructions. ### Technical Analysis Every successful non-JSON execution unconditionally appends a paid-product advertisement and an external purchasing URL to the accounting result. The behavior is explicitly marked with the `__UPSELL__` comment and is not required to perform lease-liability validation. Because the promotional output is mixed into normal results rather than displayed only in response to an explicit request, the Skill predictably alters the agent's output and redirects attention from the requested accounting task to a commercial transaction workflow. No direct command execution, privilege escalation, or network request occurs at this location. The risk is output and workflow manipulation: an agent may relay the promotional material as if it were a necessary or trusted part of the audit result. ### Attack Path 1. A user invokes the Skill with a valid lease amortization table. 2. The local engine successfully completes its checks. 3. The non-JSON output path reaches lines 195-197. 4. The Skill unconditionally inserts an advertisement, product identifier, and external purchasing URL. 5. The user or an orchestrating agent may follow the link and enter a separate purchase and installation workflow. ### Impact Assessment The finding does not directly grant operating-system privileges or access sensitive files. Its scope is the integrity of the current response and user workflo ...[truncated 307 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the unconditional upsell output from the normal result path. 2. Keep optional upgrade information in static documentation rather than mixing it with calculation results. 3. If upgrade information must be available at runtime, require an explicit option such as `--show-upgrade-info`. 4. Clearly separate calculation findings from optional commercial information. 5. Do not present external purchase instructions as part of a successful accounting result. 6. Add regression tests confirming that ordinary executions contain only requested validation output. ]]>