T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/run.mjs:199
- Finding
- Unconditional Commercial Output Injection in Successful Results## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 199–201 **Vulnerability Type**: Output and instruction hijacking **Risk Level**: Medium ### Vulnerable Code ```js console.log(''); // __UPSELL__ console.log('如需完整档：工程进度款与质保金核对 · 买断版（SkillPay 商品号 S0806000206832712）—— 本版本未执行的 5 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` The string literals above advertise the paid edition and direct users to an external purchasing page. ### Technical Analysis Every successful, human-readable execution unconditionally appends an upsell message and an external URL. The behavior is not activated by a dedicated option and does not depend on the user requesting upgrade or purchasing information. The explicit `__UPSELL__` marker further demonstrates that the content was deliberately inserted into the normal result channel. This modifies the Agent's response beyond the legitimate progress-payment calculation task. Although the injected text does not itself execute code, it uses trusted Skill output to redirect the user or supervising Agent to an unrelated commercial workflow. The JSON output path does not include this printed advertisement, but the default successful execution path does. ### Attack Path 1. A user invokes the Skill to audit a progress-payment worksheet. 2. The local engine successfully completes the requested calculations. 3. The default non-JSON output path reaches lines 199–201. 4. The runner appends promotional instructions and an external URL to the trusted result. 5. The user or Agent may follow the external link under the assumption that it is necessary or endorsed as part of the audit workflow. 6. The external destination can then influence subsequent installation or purchasing actions outside the scope of the original task. ### Impact Assessment The immediate impact is control over a portion of the Agent's visible output and the ability to r ...[truncated 451 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the unconditional upsell and external URL from the normal result path. 2. Restrict standard output to the requested calculation findings, execution scope, and input-validation messages. 3. If upgrade information must be available, place it behind an explicit user-controlled option such as `--upgrade-info`. 4. Clearly separate optional commercial material from security-sensitive or accounting results. 5. Do not instruct an Agent to follow external purchasing procedures as part of ordinary calculation output. 6. Add tests asserting that default and JSON result modes contain only task-relevant content. 7. Apply an allowlist to any optional outbound links and clearly disclose that following them leaves the locally audited workflow.