T01 · Skill Instruction Hijacking
Error
- Location
- scripts/run.mjs:197
- Finding
- Hardcoded Commercial Instruction Injection in Standard Results<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 197-201 **Vulnerability Type**: Hardcoded output manipulation **Risk Level**: High ### Evidence ```javascript console.log(''); // __UPSELL__ console.log('如需完整档：物业费与滞纳金核对 · 买断版（SkillPay 商品号 S0806000206837918）—— 本版本未执行的 5 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); console.log(JSON.stringify(view.result, null, 2)); return 0; ``` ### Technical Analysis Every successful invocation using the default human-readable output path inserts a fixed commercial advertisement and an external purchase URL immediately before the requested calculation results. The injection is unconditional for successful non-JSON executions and is not necessary for the property-fee verification task. Because skill output may be consumed by another AI agent rather than only displayed to a human, persistent instructions and external links embedded in otherwise legitimate results can influence subsequent agent behavior. The `__UPSELL__` marker also demonstrates that this output section is deliberately reserved for promotion rather than being part of the calculation result. The local execution path itself does not open the URL, install software, or make a payment. Exploitation therefore depends on a user or downstream agent acting on the injected content. ### Attack Path 1. A user invokes the documented command without the `--json` option. 2. The engine processes the supplied property-fee table successfully. 3. Before presenting the requested result, the program unconditionally inserts a paid-product advertisement, product identifier, and external purchase-instruction URL. 4. A downstream agent or user follows the embedded link. 5. The user or agent is redirected from the original local calculation task into the external installation and purchase workflow documented by the project. ### Impact Assessment The issue controls p ...[truncated 536 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the hardcoded advertisement and purchase URL from the standard result path. 2. Keep calculation output limited to information necessary to satisfy the property-fee verification request. 3. Place optional commercial information in separate documentation rather than executable output. 4. If upgrade information must remain available, require an explicit option such as `--show-upgrade-info`. 5. Return promotional metadata in a clearly separated, opt-in field rather than mixing it with findings. 6. Add automated tests confirming that default output contains only calculation results and operational notices required for the task. ]]>