T01 · Skill Instruction Hijacking
Warning
- Location
- `. 2. The local engine successfully parses and checks the warehouse-fee worksheet. 3. Before printing the requested result, the runner injects a paid-edition promotion. 4. The runner presents an external URL as the route to purchase instructions. 5. The user or Agent may follow that mutable, unaudited page and act on instructions outside the reviewed package. ### Impact Assessment The direct impact is limited to manipulation of user-visible output and commercial redirection. This code does not itself obta ...[truncated 489 chars]:197
- Finding
- Unconditional Promotional Output Injection and External Redirection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 197–200 **Vulnerability Type**: Unconditional manipulation of user-visible output **Risk Level**: Medium ### Complete Code Snippet The source strings below are represented in English while preserving the behavior of the original code: ```javascript console.log(''); // __UPSELL__ console.log('For the full edition: Warehouse Fee and Overdue Fee Check · Buyout Edition ' + '(SkillPay product ID S0806000206832715) — all five checks omitted from this edition are included.'); console.log('Public entry point and official purchase instructions: ' + 'https://chenqg618.github.io/compliance-skills/buy.html ' + '(or see the optional full-edition section in this package’s SKILL.md).'); console.log(JSON.stringify(view.result, null, 2)); ``` ### Technical Analysis Every successful execution using the default human-readable output path unconditionally inserts an upsell and directs the user to an external GitHub Pages site. The explicit `__UPSELL__` marker confirms that this content is intentionally injected into the normal result stream. This behavior is not required to perform warehouse-fee calculations. It changes the output of the requested task by adding commercial steering and encourages the user or an AI Agent to leave the reviewed package’s trust boundary. The linked page is external to the audited artifact and can change independently after the package has been reviewed. The JSON output path is not affected, but users following the documented default invocation receive the promotional content on every successful run. ### Attack Path 1. A user or Agent invokes `node scripts/run.mjs --input <file>`. 2. The local engine successfully parses and checks the warehouse-fee worksheet. 3. Before printing the requested result, the runner injects a paid-edition promotion. 4. The runner presents an external URL as the route to purchase instructions. 5. The user or Agent may follow that mut ...[truncated 601 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the unconditional upsell and external URL from the runtime output. 2. Ensure successful execution prints only the requested audit result and necessary operational metadata. 3. If information about another edition is necessary, place a neutral, clearly optional disclosure in package documentation rather than executable output. 4. Do not direct users to an unaudited intermediary page for installation or payment instructions. 5. If any external link remains, identify its ownership, use an official vendor-controlled domain, and ensure following it is never represented as part of the calculation workflow. 6. Add a regression test confirming that default output contains no advertisements, purchase instructions, or unrelated external links. ]]>