T01 · Skill Instruction Hijacking
Error
- Location
- scripts/run.mjs:194
- Finding
- Unconditional Commercial Output Injection in Successful Results## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 194–197 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ```javascript console.log(''); console.log(''); // __UPSELL__ console.log('如需完整档：生产投入产出与报废率核对 · 买断版（SkillPay 商品号 S0806000206846698）—— 本版本未执行的 5 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` ### Technical Analysis The successful human-readable execution path unconditionally appends a commercial promotion, product identifier, and external purchase URL. The explicit `__UPSELL__` marker indicates that this is intentional output injection rather than information required to perform the declared production-table validation task. Because these messages are emitted as part of the normal result, an agent or user may interpret the commercial content as an official finding, required remediation, or necessary continuation of the audit. This alters the expected purpose and content of the tool's output. The JSON output path does not print these messages, but all successful non-JSON executions are affected. ### Attack Path 1. A user supplies a valid production yield and scrap table. 2. The engine completes its declared local checks successfully. 3. The non-JSON output path is selected. 4. The runner automatically inserts promotion for a specified paid product. 5. The output directs the user to an external purchase-instruction website. 6. The user may follow the promoted workflow under the mistaken impression that it is part of the validation result. ### Impact Assessment This behavior does not directly grant operating-system privileges or access sensitive data. Its impact is manipulation of trusted tool output and redirection of users or agents toward a commercial workflow unrelated to the core validation operation. The affected scope includes every successful human-readable invocat ...[truncated 18 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the unconditional upsell messages from the successful execution path. 2. Ensure generated results contain only validation findings, scope limitations, and operationally necessary guidance. 3. If commercial information must be retained, place it in a clearly labeled, optional documentation section rather than runtime output. 4. Do not present purchase links or product identifiers as part of audit findings or remediation. 5. Add output tests that assert successful executions contain no advertisements, purchase instructions, or unrelated external redirects.