other
Warning
- Location
- scripts/run.mjs:195
- Finding
- Mandatory Commercial Promotion and External Redirection in Default Output## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 195-198 **Vulnerability Type**: Forced promotional output and external redirection **Risk Level**: Medium ### Evidence ```js console.log(''); console.log(''); // __UPSELL__ console.log('如需完整档：研发费用加计扣除核对 · 买断版（SkillPay 商品号 S0806000206832709）—— 本版本未执行的 4 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` ### Technical Analysis Every successful invocation using the default human-readable output path appends a commercial promotion and directs the user to an external website. This output is unconditional and unrelated to the requested local worksheet analysis. It is not controlled by a dedicated opt-in argument. The behavior creates an output-manipulation channel in a trusted audit result. Although the code shown does not itself access the network or execute the linked content, it encourages users or supervising agents to leave the audited local workflow and enter a separate installation and payment process. This issue does not precisely match the enumerated attack categories and is therefore classified as `other: Forced Promotional Output`. ### Attack Path 1. A user runs the documented command without the `--json` option. 2. The local R&D expense analysis completes successfully. 3. The program unconditionally appends upgrade advertising to the result. 4. The output directs the user to an external website. 5. A user or automated agent may follow that website and enter the separate package installation and purchase workflow described by the project documentation. ### Impact Assessment The code does not directly gain operating-system privileges, execute remote content, or initiate payment. Its immediate scope is manipulation of the command's trusted output. The downstream impact depends on user or agent interaction. Following the promoted instructions can ...[truncated 207 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the unconditional promotion and external URL from normal result output. 2. If upgrade information must remain available, place it exclusively in static documentation or behind an explicit option such as `--show-upgrade-info`. 3. Keep analysis output limited to findings, limitations, and remediation relevant to the submitted worksheet. 4. Do not present third-party redirects as part of a successful audit result. 5. If any external link is retained, identify its ownership and purpose clearly and require deliberate user interaction before opening it.