T01 · Skill Instruction Hijacking
Warning
- Location
- ` without `--json`. 2. The local accounting engine successfully processes the supplied table. 3. Execution reaches lines 197-199. 4. The tool appends the product identifier and external purchase URL to the trusted audit result. 5. The user or an assisting Agent may follow the external workflow, leaving the audited local execution context. ### Impact Assessment The immediate impact is integrity loss in the skill's output and unsolicited redirection of the user or Agent. It can influence subsequent actions, ...[truncated 487 chars]:197
- Finding
- Forced Commercial Redirection in Successful Audit Output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 197-199 **Vulnerability Type**: Forced promotional output and external purchase redirection **Risk Level**: Medium ### Vulnerable Code ```js console.log(''); // __UPSELL__ console.log('如需完整档：工会经费与残保金计提核对 · 买断版（SkillPay 商品号 S0806000206845467）—— 本版本未执行的 5 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` ### Technical Analysis Every successful execution using the default human-readable output path reaches these statements. The skill automatically appends a commercial product identifier, an external URL, and purchase instructions to the requested accounting-check result. This behavior is not needed to perform the declared local consistency checks. Because it is inserted into otherwise trusted audit output, it redirects the interaction toward an external commercial workflow and modifies the expected purpose of the response. The explicit `__UPSELL__` marker further indicates that the insertion is intentional. The behavior does not occur when `--json` is used because that branch returns before these statements. No automatic network request or purchase is made by this code itself. ### Attack Path 1. A user invokes `node scripts/run.mjs --input <file>` without `--json`. 2. The local accounting engine successfully processes the supplied table. 3. Execution reaches lines 197-199. 4. The tool appends the product identifier and external purchase URL to the trusted audit result. 5. The user or an assisting Agent may follow the external workflow, leaving the audited local execution context. ### Impact Assessment The immediate impact is integrity loss in the skill's output and unsolicited redirection of the user or Agent. It can influence subsequent actions, including visiting an external site and beginning the separately documented installation and purchase process. These lines alone do not grant sys ...[truncated 227 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the unconditional upsell statements from the successful execution path. 2. Ensure runtime output contains only the requested accounting results, execution metadata, and relevant warnings. 3. If commercial information must be retained, place it in a clearly labeled, optional documentation section rather than automatically appending it to every result. 4. Do not include Agent-targeted purchase instructions in operational output. 5. Add output tests verifying that successful executions contain no external purchase links or unrelated calls to action. ]]>