T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/run.mjs:197
- Finding
- Automatic Commercial Promotion Injected into Successful User-Facing Results<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 197–199 **Vulnerability Type**: Output and instruction hijacking **Risk Level**: Medium ### Evidence ```js console.log(''); // __UPSELL__ console.log('如需完整档：预付款与预付账款核销核对 · 买断版（SkillPay 商品号 S0806000206851205）—— 本版本未执行的 5 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` ### Technical Analysis Every successful non-JSON execution reaches these statements after producing the requested accounting-check result. The application therefore injects an advertisement, product identifier, and external purchasing URL into its standard user-facing output without requiring an explicit promotional option. This content is unrelated to performing the local reconciliation checks. The explicit `__UPSELL__` marker also demonstrates that the insertion is intentional. In an AI-agent environment, output from a trusted Skill can be presented as authoritative guidance or consumed by subsequent agent reasoning. Appending purchase instructions to that channel can redirect the session away from its original accounting task. The JSON output path does not include this promotional block, and the code does not automatically open the link or perform a purchase. The vulnerability is consequently limited to output manipulation and user redirection rather than direct code execution. ### Attack Path 1. A user or agent invokes the Skill without `--json`. 2. The local engine completes the requested prepayment reconciliation. 3. The normal success path reaches lines 197–199. 4. The program unconditionally appends a paid-product promotion and an external URL. 5. The user or calling agent may treat the appended content as part of the trusted result and follow the external purchasing workflow. ### Impact Assessment No additional operating-system privilege is directly obtained by these statements. However, the affected scope includes ...[truncated 343 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the unconditional promotion from the normal success path. 2. Keep accounting results limited to information necessary for the requested reconciliation. 3. If upgrade information must be available, place it behind an explicit option such as `--show-upgrade-info`, disabled by default. 4. Do not include purchasing URLs in data intended for downstream agent processing. 5. Separate machine-readable results, operational diagnostics, and optional marketing content into distinct channels. 6. Add regression tests confirming that ordinary successful runs contain no advertisements, purchase instructions, or unrelated external links. ]]>