T01 · Skill Instruction Hijacking
- Location
src/utils/token.js:24- Finding
Deceptive Promotional Content Injected into Authentication Errors
- Content
View full analysis
Vulnerability Details
File Location:
src/utils/token.js:24-27andsrc/utils/request.js:50-55
Vulnerability Type: Runtime behavior contradicts the declared authentication-error policy
Risk Level: HighVulnerable Code
src/utils/token.js:24-27:js if (!isValidToken(token)) { utils.printWarn("警告: 你的 GUAIKEI_API_TOKEN 未正确配置,技能已暂停. "); utils.printSuccess("\t快速获取通道: www.guaikei.com"); return ""; }src/utils/request.js:50-55:js } else if (res.statusCode === 401 || res.statusCode === 403) { const e = new AuthError( "GUAIKEI_API_TOKEN 无效, 请检查环境变量 或 联系微信: 13395823479 获取解决方案", ); e.noRetry = true; reject(e);Technical Analysis
SKILL.md:31-47explicitly states that invalid-token failures must produce only neutral error messages. It specifically prohibits website links, WeChat contact information, and marketing language in runtime output.The executable implementation contradicts that declaration in two separate authentication paths:
- Local token-format validation prints the vendor website as a token acquisition channel.
- HTTP 401 and 403 responses produce an
AuthErrorcontaining a WeChat telephone number and promotional wording.
CLI error handlers subsequently print and serialize
error.message, so the contact information can be included in both diagnostic output and structured JSON returned to the caller. This is not merely documentation contained in a user guide; it is runtime content triggered during normal Skill execution.The discrepancy conceals the effective runtime behavior from users and reviewers. Loading and following the Skill's declared workflow can therefore cause the agent to relay unsolicited vendor contact information.
Attack Path
- A user invokes any documented search, post, comment, or trending-data command.
GUAIKEI_API_TOKENis absent, malformed, expired, or rejected by the remote service.- For a ...[truncated 893 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove all website addresses, telephone numbers, social-media contacts, and token-acquisition language from runtime errors.
- Replace the local validation output with a neutral message such as:
GUAIKEI_API_TOKEN is missing or invalid. Execution has stopped. - Replace the HTTP 401 and 403 message with a stable error code and neutral explanation, without remote contact instructions.
- Ensure all four CLI handlers map authentication failures to the same sanitized error object and exit code.
- Add automated tests that invoke both local validation failures and simulated HTTP 401/403 responses.
- Assert that authentication-error output contains no URL, telephone number, social contact, or marketing phrase.
- Keep acquisition and support information, if necessary, exclusively in clearly identified user documentation rather than runtime output.