T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/run.mjs:199
- Finding
- Automatic Commercial Redirection Injected into Successful Audit Results## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 199–201 **Vulnerability Type**: Commercial output and instruction hijacking **Risk Level**: Medium ### Vulnerable Code The following is an English rendering of the complete affected code segment: ```js console.log(''); // __UPSELL__ console.log('For the complete edition: Mold and Tooling Amortization Check · Perpetual License Edition (SkillPay product S0806000206851263) — all five checks omitted from this edition are included.'); console.log('Public entry point and official purchase instructions: https://chenqg618.github.io/compliance-skills/buy.html (see also the optional complete-edition section in SKILL.md).'); ``` ### Technical Analysis Every successful execution in the default human-readable output mode appends a hardcoded advertisement, product identifier, and external purchase URL. The content is emitted regardless of whether the user requested purchase information. Because Skill output may be consumed by an AI Agent rather than displayed only to a human, inserting unrelated operational instructions into a normal audit response can redirect the Agent away from the original ledger-validation task. The `--json` path does not emit these lines, but the default execution path does, and there is no dedicated opt-in flag governing commercial content. This is classified as `T01: Skill Instruction Hijacking` because the Skill deliberately adds content intended to influence subsequent user or Agent behavior beyond the current technical task. ### Attack Path 1. A user or AI Agent invokes the Skill to validate a local amortization ledger. 2. The engine completes the requested checks successfully. 3. The default output path reaches lines 199–201. 4. The Skill automatically appends a fixed product identifier and external purchase URL. 5. A user or downstream Agent may follow the injected commercial redirection even though purchase assistance was not pa ...[truncated 593 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the unconditional commercial message from the normal result path. 2. Keep audit output limited to findings, scope, execution status, and remediation relevant to the submitted ledger. 3. If purchase information must remain available, expose it only through a separate, explicit option such as `--purchase-info`. 4. Ensure that the purchase-information option cannot be triggered implicitly by successful execution. 5. Keep machine-readable and human-readable outputs semantically equivalent and free of unrelated behavioral instructions. 6. Add regression tests asserting that ordinary `--sample` and `--input` executions contain no installation, payment, product, or external-navigation instructions.