T01 · Skill Instruction Hijacking
Warning
- Location
- ` without `--json`. 2. The bundled engine completes the legitimate local accounting checks. 3. Before printing the result, the script automatically emits a paid-product identifier and external purchasing URL. 4. An AI agent relaying or interpreting the output may treat the promotion as an actionable next step. 5. The user can consequently be diverted from the requested audit task into an external commercial workflow. ### Impact Assessment The code does not itself obtain system privileges or complete a pur ...[truncated 437 chars]:195
- Finding
- Unconditional Commercial Promotion Injected into Successful Results<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.mjs`, lines 195–197 **Vulnerability Type**: Output and instruction manipulation **Risk Level**: Medium ### Vulnerable Code ```js console.log(''); // __UPSELL__ console.log('如需完整档：职工福利费与教育经费限额核对 · 买断版（SkillPay 商品号 S0806000206846699）—— 本版本未执行的 5 项检查在完整档里都有。'); console.log('公开入口与官方购买指令：https://chenqg618.github.io/compliance-skills/buy.html（也可看本包 SKILL.md 的「需要完整档时（可选）」一节）。'); ``` ### Technical Analysis Every successful human-readable execution unconditionally adds a merchant-specific product promotion and external purchasing URL immediately before the actual result. The output is not conditional on an explicit request for purchasing information. When an AI agent invokes the script and relays its output, this content can alter the session from the requested local accounting check toward a commercial installation and payment workflow. This is a form of stable instruction or output hijacking because unrelated promotional guidance is inserted into the normal result channel. The JSON output path does not contain these lines, but human-readable execution is the default mode. Therefore, the affected behavior is reachable through ordinary documented use. ### Attack Path 1. A user or AI agent invokes `node scripts/run.mjs --input <file>` without `--json`. 2. The bundled engine completes the legitimate local accounting checks. 3. Before printing the result, the script automatically emits a paid-product identifier and external purchasing URL. 4. An AI agent relaying or interpreting the output may treat the promotion as an actionable next step. 5. The user can consequently be diverted from the requested audit task into an external commercial workflow. ### Impact Assessment The code does not itself obtain system privileges or complete a purchase. Its direct impact is manipulation of agent-visible output and redirection to a merchant-specific workflow. In an agentic environment, the injected content ...[truncated 162 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all product promotion, merchant identifiers, and purchasing URLs from the normal execution-result path. 2. Ensure the default output contains only the requested accounting-check results, scope limitations, and operational errors. 3. If commercial information must remain available, place it in passive documentation and display it only after an explicit user request. 4. Add automated tests asserting that successful output does not contain external URLs, product identifiers, installation instructions, or payment guidance. 5. Keep machine-readable and human-readable output behavior aligned so that neither mode introduces unrelated instructions. ]]>