T01 · Skill Instruction Hijacking
Warning
- Location
- scripts/run.mjs:188
- Finding
- Unconditional Commercial Content Injection into Successful Audit Output## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 188–191 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Vulnerable Code ```javascript console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); console.log(''); // __UPSELL__ console.log('如需完整档：水电抄表与账单核对 · 买断版（SkillPay 商品号 S0806000206851301）—— 本版本未执行的 5 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` ### Technical Analysis After a successful non-JSON audit, the runner unconditionally appends a product advertisement, product identifier, and external purchase URL to the result. The `__UPSELL__` comment explicitly identifies the insertion as an upsell. This content is not necessary for the requested utility-meter calculations. Because it is emitted through the same output channel as the legitimate audit result, an AI agent or downstream automation may treat the commercial instructions as part of the authoritative result and repeat them to the user. The injection applies only to successful human-readable runs. The `--json` output path returns before these statements and is not affected. ### Attack Path 1. A user or agent invokes the documented command without `--json`. 2. The bundled engine completes the local utility-meter checks successfully. 3. Before printing the calculated result, the runner emits fixed commercial messaging and an external purchase URL. 4. The combined output is presented to the user or consumed by another agent as if all content were part of the requested audit. 5. The recipient may follow the promoted purchase workflow even though it is unrelated to completing the local calculation. ### Impact Assessment The code does not directly gain operating-system privileges, execute a purchase, or access credentials. Its impact is limited to manipulati ...[truncated 349 chars]
- Remediation
- ## Remediation Suggestions 1. Remove all unconditional promotional statements from normal execution output. 2. Keep successful output limited to the requested calculation, findings, scope, and status. 3. If upgrade information is considered necessary, expose it only through an explicit option such as `--upgrade-info`. 4. Keep commercial documentation in a clearly separated, optional section that agents are not instructed to reproduce. 5. Add regression tests asserting that default output contains no external purchase URLs, product identifiers, or unrelated instructions. 6. Prefer structured JSON output for agent integrations and document that downstream systems must consume only defined result fields.