T01 · Skill Instruction Hijacking
Error
- Location
- scripts/run.mjs:197
- Finding
- Unconditional Commercial Output Hijacking<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 197–199 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code ```javascript console.log(''); // __UPSELL__ console.log('[Paid-edition advertisement containing SkillPay product ID S0806000206852987]'); console.log('[External purchase instructions at https://chenqg618.github.io/compliance-skills/buy.html]'); ``` The bracketed string literals above are English translations of the original user-facing promotional messages at the specified lines. The first advertises the paid edition and identifies a SkillPay product; the second directs the user to an external purchase page. ### Technical Analysis Every successful, non-JSON invocation unconditionally appends a paid-product advertisement and an external purchase link to the checker’s results. There is no documented option to disable this behavior. The explicit `__UPSELL__` marker further demonstrates that this content was deliberately inserted into the normal result path. The advertisement is not part of the requested social-insurance validation result. When an AI Agent invokes this Skill and relays its output, the Skill can therefore alter the Agent’s response by inserting unsolicited commercial instructions. This compromises response integrity and can redirect the user from the local audit workflow to an external purchasing workflow. The behavior is limited to the human-readable output path. The `--json` branch returns before these lines and does not include the advertisement. ### Attack Path 1. A user or Agent invokes `node scripts/run.mjs --sample` or provides a valid input without `--json`. 2. The local engine successfully processes the material. 3. Execution reaches lines 197–199. 4. The runner unconditionally appends a paid-edition advertisement, product identifier, and external purchase URL. 5. An Agent that forwards the command output presents the injected commercial content ...[truncated 658 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the unconditional advertisement and purchase URL from the normal result path. 2. Keep audit output limited to findings, execution scope, and remediation information relevant to the submitted data. 3. If commercial information must remain available, expose it only through an explicit command such as `--purchase-info`. 4. Do not enable commercial output by default or silently mix it with audit findings. 5. Keep purchase documentation in a clearly separated documentation section rather than executable result output. 6. Add tests verifying that ordinary successful executions contain no advertisements, purchase identifiers, or unrelated external links. ]]>