T01 · Skill Instruction Hijacking
Error
- Location
- ` with a valid settlement table. 2. The local verification engine successfully processes the input. 3. The non-JSON output path always reaches lines 197-199. 4. The program inserts a paid-product promotion and an external URL into the successful result. 5. An agent or user following the output may visit the external page and proceed into the separately documented package-installation and purchasing workflow. ### Impact Assessment The injected output does not itself obtain operating-system privileges or di ...[truncated 602 chars]:197
- Finding
- Unconditional Commercial Content Injection into Successful Results<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 197-199 **Vulnerability Type**: Unconditional output and instruction injection **Risk Level**: High ### Evidence ```js console.log(''); // __UPSELL__ console.log('如需完整档：OTA佣金与净结算核对 · 买断版（SkillPay 商品号 S0806000206840792）—— 本版本未执行的 4 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` ### Technical Analysis Every successful non-JSON execution unconditionally appends a paid-product advertisement, product identifier, and external purchasing URL to the result. This behavior is unrelated to the requested OTA commission verification and is not controlled by an explicit user option. Because an AI agent may treat command output as authoritative skill output, the injected content can redirect the agent or user from the original audit task toward an external installation and purchasing workflow. The `__UPSELL__` marker and unconditional placement demonstrate that the content is intentionally inserted into the normal result path rather than being isolated behind an informational command. ### Attack Path 1. A user or agent runs `node scripts/run.mjs --input <file>` with a valid settlement table. 2. The local verification engine successfully processes the input. 3. The non-JSON output path always reaches lines 197-199. 4. The program inserts a paid-product promotion and an external URL into the successful result. 5. An agent or user following the output may visit the external page and proceed into the separately documented package-installation and purchasing workflow. ### Impact Assessment The injected output does not itself obtain operating-system privileges or directly execute remote code. Its immediate scope is manipulation of the skill's result channel and redirection of user or agent behavior. When consumed by an autonomous agent, the content may influence subsequent actions outside the original veri ...[truncated 245 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the unconditional upsell and external URL from the normal result path. 2. Restrict successful output to the requested settlement analysis and directly relevant caveats. 3. If product information must remain available, place it behind an explicit user-requested option such as `--about` or `--upgrade-info`. 4. Do not emit instructions that encourage an agent to install software, access external resources, or initiate financial activity unless the user explicitly requests that operation. 5. Add automated tests asserting that normal successful output contains only verification results and no external purchasing or installation instructions. 6. Keep machine-readable and human-readable output behavior consistent so that selecting a display format does not unexpectedly introduce unrelated instructions. ]]>