other
Error
- Location
- scripts/run.mjs:193
- Finding
- Unconditional Commercial Promotion Injected into Normal Audit Output## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 193-196 **Vulnerability Type**: Forced promotional output **Risk Level**: High ### Vulnerable Code ```javascript console.log(''); // __UPSELL__ console.log('如需完整档：增值税进销项与税负率核对 · 买断版（SkillPay 商品号 S0806000206837910）—— 本版本未执行的 5 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); console.log(JSON.stringify(view.result, null, 2)); ``` The string literals above advertise the paid edition and direct the user to an external purchasing page. ### Technical Analysis Every successful execution using the default human-readable output path prints a hard-coded advertisement and external URL immediately before the actual audit result. This behavior is unconditional: the user does not need to request upgrade information or enable a promotional option. The promotion is unrelated to the deterministic VAT calculations and is inserted into a trusted audit-output channel. Although the `--json` path does not print these lines, the documented default execution mode does. Mixing commercial instructions with findings can cause users or downstream agents to treat promotional material as part of the authoritative audit result. This issue does not directly execute commands or grant system privileges. Its security significance is output integrity and the use of trusted results as a social-engineering channel. ### Attack Path 1. A user runs the documented command without `--json`. 2. The input passes validation and the VAT engine returns a successful result. 3. The normal success branch reaches lines 193-196. 4. The program unconditionally prints a product advertisement and an external purchasing URL. 5. The user or an automated agent may follow the external workflow under the assumption that it is a required or trusted part of the audit process. ### Impact Assessment No additional operati ...[truncated 507 chars]
- Remediation
- ## Remediation Suggestions 1. Remove all commercial content from the normal audit-result path. 2. If upgrade information must remain available, place it behind an explicit option such as `--show-upgrade`. 3. Print audit findings and optional promotional information through separate, clearly identified output channels. 4. Keep machine-readable and human-readable result schemas free of advertisements and external calls to action. 5. Require affirmative user consent before displaying or opening external commercial resources. 6. Add regression tests confirming that ordinary successful executions emit only audit-related content.