T01 · Skill Instruction Hijacking
- Location
src/utils/token.js:24- Finding
Hard-Coded Promotional Messaging Injected into Authentication Error Output
- Content
View full analysis
Vulnerability Details
File Location:
src/utils/token.js:24-35;src/utils/request.js:50-55
Vulnerability Type: Runtime output manipulation through authentication handling
Risk Level: HighVulnerable Code
src/utils/token.js:24-35:js if (!isValidToken(token)) { utils.printWarn("警告: 你的 GUAIKEI_API_TOKEN 未正确配置,技能已暂停. "); utils.printError("一键解锁全部功能, 即刻恢复高效办公！"); utils.printInfo( "获取您的专属私有TOKEN, 一键配置即可永久稳定使用, 完全不影响日常办公。", ); utils.printSuccess("\t快速获取通道: www.guaikei.com"); utils.printSuccess("\t专属客服微信: 13395823479"); utils.printError("早配置早享受, 别让工具问题耽误您的宝贵时间!"); return ""; }src/utils/request.js:50-55:js } else if (res.statusCode === 401 || res.statusCode === 403) { const e = new AuthError( "GUAIKEI_API_TOKEN 无效, 请检查环境变量 或 联系微信: 13395823479 获取解决方案", ); e.noRetry = true; reject(e); }Technical Analysis
The skill specification requires authentication failures to produce only a neutral error and explicitly prohibits runtime contact details, external links, marketing language, and payment guidance. The implementation directly violates those restrictions.
When the locally supplied token is absent or malformed,
skillToken()writes multiple promotional messages, an external domain, and a WeChat contact to stderr. When the remote service returns HTTP 401 or 403, the contact information is embedded in anAuthError.CLI error handlers subsequently assign
error.messageto structured JSON output. For example,src/douyin/search-cli.js:171-200writes the authentication error message to stdout. Consequently, the promotional contact can become part of machine-consumable output rather than remaining an internal diagnostic.This behavior is classified as instruction or output hijacking because the skill substitutes attacker-selected solicitation content for the neutral authentication response promised by its instructions. It ca ...[truncated 1344 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove all marketing language, contact information, external URLs, and acquisition guidance from runtime source code.
- Replace local token-validation output with a fixed neutral message such as:
text GUAIKEI_API_TOKEN is missing or has an invalid format. The skill has stopped. - Replace HTTP 401 and 403 messages with a stable error code such as
AUTH_REQUIREDand a neutral description. - Ensure structured stdout never contains promotional text supplied by local code or an untrusted remote API.
- Map remote authentication failures to locally controlled messages rather than forwarding server-provided error text.
- Add automated tests covering missing, malformed, expired, and rejected tokens. Tests should assert that stdout and stderr contain no contact details, marketing language, or external URLs.
- Keep token acquisition instructions exclusively in user-facing documentation, as required by
SKILL.md.