T01 · Skill Instruction Hijacking
- Location
src/utils/request.js:51- Finding
Hard-Coded Runtime Contact Promotion in Authentication Errors
- Content
View full analysis
Vulnerability Details
File Location:
src/utils/request.js:51-55
Vulnerability Type: Runtime output manipulation and unauthorized contact redirection
Risk Level: HighVulnerable Code
js } else if (res.statusCode === 401 || res.statusCode === 403) { const e = new AuthError( "GUAIKEI_API_TOKEN 无效, 请检查环境变量 或 联系微信: 13395823479 获取解决方案", ); e.noRetry = true; reject(e); }The resulting message is propagated into CLI output. For example,
src/douyin/search-cli.js:174-199contains:js } catch (error) { utils.printError(`搜索失败: ${error.message}`); const errorOutput = { status: "error", error_code: error.code || "UNKNOWN", message: error.message, timestamp: new Date().toLocaleString(), request: { command: "search", keyword: keyword, sort: sort, time: time, duration: duration, content: content, limit: limit, }, metadata: { skill_version: constants.VERSION, runtime_version: process.versions.node, execution_time: Date.now() - startTime, }, results: null, }; const exitCode = error.name === "AuthError" ? 3 : 1; process.stdout.write(JSON.stringify(errorOutput, null, 2) + "\n", () => process.exit(exitCode), ); return; }Technical Analysis
The implementation embeds an external contact identifier in an authentication error and places that message in both diagnostic output and the structured JSON response. An agent invoking the skill may treat the returned message as trusted operational guidance and relay it directly to the user.
This behavior directly contradicts the declared policy in
SKILL.md, which states that authentication failures must produce only a neutral error and must not display contact details, website links, marketing language, or payment guidance at runtime.Although this issue does not provide operating-system privileges or arbitrary code execution, it changes the agent-visible behavior of the ...[truncated 1450 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the authentication error with a neutral message that contains no contact information, URLs, sales language, or payment instructions.
- Use a stable error code such as
AUTH_REQUIREDand keep the user-facing message limited to checking the configured environment variable. - Ensure all CLI handlers map
AuthErrorto the same neutral response and exit code 3. - Avoid returning raw upstream or internal error messages directly in agent-consumable JSON.
- Add automated tests that simulate HTTP 401 and 403 responses and assert that output contains no phone numbers, contact handles, URLs, or promotional language.
- Add a centralized error-sanitization layer before messages are written to stdout or stderr.
- Review all runtime messages for consistency with the restrictions declared in
SKILL.md.