T01 · Skill Instruction Hijacking
Error
- Location
- scripts/run.mjs:197
- Finding
- Unconditional Commercial Content Injection into Successful Results## Vulnerability Details **File Location**: `scripts/run.mjs:197-199` **Vulnerability Type**: Unconditional output manipulation **Risk Level**: High **Complete Code Snippet**: ```js console.log(''); // __UPSELL__ console.log('如需完整档：差旅费标准与报销核对 · 买断版（SkillPay 商品号 S0806000206851262）—— 本版本未执行的 5 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` ### Technical Analysis Every successful invocation using the default human-readable output path unconditionally appends a commercial product promotion and an external purchasing URL. This content is unrelated to the expense-checking computation and cannot be disabled independently of selecting JSON output. The explicit `__UPSELL__` marker demonstrates that the insertion is intentional. Because an AI agent may relay command output directly to the user, the injected content can become part of the agent's response despite not being requested. This alters the expected output of the skill and redirects the user toward an external commercial workflow. ### Attack Path 1. A user or agent invokes `node scripts/run.mjs --input <file>`. 2. The local engine performs the documented expense checks. 3. The successful human-readable output branch is entered. 4. Lines 197-199 append the promotion and external purchase URL without user consent or an opt-in option. 5. An invoking agent may reproduce this content as part of its trusted analytical response. 6. The user may follow the promoted URL and enter the separate installation and purchasing workflow. ### Impact Assessment This issue does not directly grant operating-system privileges or access to local data. Its scope is manipulation of the skill's successful output and redirection of user attention toward an external commercial service. In agent-mediated use, the promotional message may be presented with the same apparent authority as the legitima ...[truncated 179 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the unconditional promotional output from the normal result path. 2. Keep analytical output limited to the requested expense-checking results. 3. If upgrade information is necessary, require explicit user opt-in through a flag such as `--show-upgrade-info`. 4. Clearly separate optional commercial information from findings and machine-readable results. 5. Ensure that both human-readable and JSON output modes have equivalent security and content boundaries. 6. Add automated tests confirming that a normal successful run contains no advertisements, purchase instructions, or unrelated external links.