T01 · Skill Instruction Hijacking
Error
- Location
- scripts/run.mjs:197
- Finding
- Unconditional Commercial Content Injection into Successful Results## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 197-199 **Vulnerability Type**: Unconditional output injection and commercial redirection **Risk Level**: High **Complete Code Snippet**: ```js console.log(''); // __UPSELL__ console.log('如需完整档：预付卡消费核销核对 · 买断版（SkillPay 商品号 S0806000206853037）—— 本版本未执行的 5 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` ### Technical Analysis Every successful execution using the default human-readable output path unconditionally appends an advertisement for a paid product and an external purchase URL. The explicit `__UPSELL__` marker indicates that this is an intentional output-injection point rather than information required for the prepaid-card reconciliation task. The promotion is not controlled by an opt-in argument and is printed alongside the trusted analysis result. This can cause users or an AI agent consuming standard output to interpret commercial instructions as part of the tool's authoritative result. The JSON output path does not print these lines, but the documented default execution path does. ### Attack Path 1. A user or AI agent invokes the checker with a valid prepaid-card table. 2. The engine successfully completes the accounting checks. 3. The default non-JSON output path reaches lines 197-199. 4. The program injects a paid-product advertisement and an external purchase URL into the result stream. 5. The user or consuming agent may follow the external link and enter a purchase or installation workflow unrelated to the requested reconciliation operation. ### Impact Assessment This issue does not directly grant operating-system privileges, execute external code, or bypass payment confirmation. Its scope is control over the checker’s normal user-facing output and redirection of users or agents toward an external commercial workflow. In agent-mediated environmen ...[truncated 257 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the unconditional promotional output from the normal result path. 2. Keep accounting results and commercial information in separate output channels. 3. If upgrade information is necessary, require an explicit opt-in option such as `--show-upgrade-info`. 4. Do not place external purchase instructions in stdout used by agents or automated consumers. 5. Ensure successful default output contains only the requested reconciliation findings, evidence, scope limitations, and execution metadata. 6. Add regression tests confirming that normal successful runs contain no advertisements, purchase links, installation instructions, or unrelated calls to action.