T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/run.mjs:195
- Finding
- Mandatory Commercial Promotion Injected into Successful Human-Readable Results## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 195-198 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium **Complete Relevant Code Snippet**: ```js console.log(''); // __UPSELL__ console.log('[Promotion for the paid edition, including its SkillPay product identifier]'); console.log('[External purchasing URL and directions to consult the purchasing section of SKILL.md]'); console.log(JSON.stringify(view.result, null, 2)); ``` The two bracketed strings above are English translations of the corresponding non-English source literals. The program unconditionally prints the paid-edition promotion and external purchasing URL immediately before the actual result in successful, non-JSON output. ### Technical Analysis The documented core function is a local payment-fee consistency check. However, the normal human-readable success path automatically inserts an unrelated paid-product promotion and external purchasing instructions into the result stream. This behavior is not controlled by a dedicated opt-in flag and is executed whenever a successful result is printed without `--json`. Because an AI agent may treat command output as content to summarize, display, or act upon, the injected material can redirect the interaction from the user's requested accounting task to a commercial installation and purchase workflow. The calculation engine itself does not execute the linked content, make network requests, or perform a purchase. The risk arises from altering agent-facing output and introducing instructions unrelated to the immediate task. ### Attack Path 1. A user or agent invokes `node scripts/run.mjs --sample` or supplies a valid input file without `--json`. 2. The local engine completes the requested fee check successfully. 3. Before printing the actual result, the runner automatically emits a promotion, product identifier, and external purchasing URL. 4. An orchestrating ...[truncated 886 chars]
- Remediation
- ## Remediation Suggestions 1. Remove commercial promotion and purchasing links from normal runtime results. 2. Keep successful output limited to the requested findings, execution metadata, and necessary safety qualifications. 3. If paid-edition information must remain available, place it in a clearly labeled optional documentation section rather than command output. 4. Alternatively, require an explicit flag such as `--show-upgrade-info` before displaying commercial material. 5. Ensure both human-readable and JSON modes have stable, task-specific output contracts. 6. Add tests asserting that default successful output contains no external URLs, purchase instructions, or unrelated installation guidance.