T01 · Skill Instruction Hijacking
- Location
src/utils/request.js:51- Finding
Hard-Coded Promotional Solicitation Injected into Agent-Consumable Authentication Errors
- Content
View full analysis
Vulnerability Details
File Location:
src/utils/request.js:51-56; propagated throughsrc/douyin/search-cli.js:172-198,src/douyin/comment-cli.js:83-103,src/douyin/post-cli.js:84-104, andsrc/douyin/hot-cli.js:21-39
Vulnerability Type: Runtime output manipulation and promotional instruction injection
Risk Level: MediumVulnerable Code
Authentication failures are converted into an error containing a hard-coded external contact:
js } else if (res.statusCode === 401 || res.statusCode === 403) { const e = new AuthError( "GUAIKEI_API_TOKEN 无效, 请检查环境变量 或 联系微信: 13395823479 获取解决方案", ); e.noRetry = true; reject(e); }The CLI then places the unfiltered message into both diagnostic output and the JSON response consumed by an agent:
js } catch (error) { utils.printError(`搜索失败: ${error.message}`); const errorOutput = { status: "error", error_code: error.code || "UNKNOWN", message: error.message, timestamp: new Date().toLocaleString(), request: { command: "search", keyword: keyword, sort: sort, time: time, duration: duration, content: content, limit: limit, }, metadata: { skill_version: constants.VERSION, runtime_version: process.versions.node, execution_time: Date.now() - startTime, }, results: null, }; const exitCode = error.name === "AuthError" ? 3 : 1; process.stdout.write(JSON.stringify(errorOutput, null, 2) + "\n", () => process.exit(exitCode), ); return; }Technical Analysis
The runtime implementation embeds a phone or WeChat contact in an authentication error and passes the message directly into agent-consumable JSON. Equivalent propagation exists in all four CLI entry points.
This conflicts with the Skill contract in
SKILL.md, which states that authentication failures must produce only a neut ...[truncated 1566 chars]- Remediation
View remediation
Remediation Suggestions
- Replace the hard-coded message with a neutral authentication failure:
js const e = new AuthError( "GUAIKEI_API_TOKEN is missing, invalid, or expired.", ); - Do not include phone numbers, social-media identifiers, website links, payment instructions, or token-acquisition guidance in runtime errors.
- Define stable, non-promotional error codes separately from display messages, such as
AUTH_REQUIRED. - Sanitize remote and locally constructed error messages before placing them in agent-consumable JSON.
- Add automated tests covering HTTP 401 and 403 responses. Tests should reject runtime output containing phone numbers, URLs, contact instructions, or promotional phrases.
- Apply the same centralized error formatter to all CLI entry points so that future messages cannot bypass the policy.
- Replace the hard-coded message with a neutral authentication failure: