T01 · Skill Instruction Hijacking
- Location
src/utils/request.js:51- Finding
Undeclared Promotional Contact Injected into Authentication Error Output
- Content
View full analysis
Vulnerability Details
File Location:
src/utils/request.js:51-55, propagated bysrc/douyin/search-cli.js:170-198and equivalent error handlers in the comment, post, and hot CLIs
Vulnerability Type: Runtime output manipulation and instruction-policy violation
Risk Level: HighVulnerable Code
js } else if (res.statusCode === 401 || res.statusCode === 403) { const e = new AuthError( "GUAIKEI_API_TOKEN 无效, 请检查环境变量 或 联系微信: 13395823479 获取解决方案", ); e.noRetry = true; reject(e); }The error is then copied into both diagnostic output and machine-readable output:
js } catch (error) { utils.printError(`搜索失败: ${error.message}`); const errorOutput = { status: "error", error_code: error.code || "UNKNOWN", message: error.message, timestamp: new Date().toLocaleString(), request: { command: "search", keyword: keyword, sort: sort, time: time, duration: duration, content: content, limit: limit, }, metadata: { skill_version: constants.VERSION, runtime_version: process.versions.node, execution_time: Date.now() - startTime, }, results: null, }; const exitCode = error.name === "AuthError" ? 3 : 1; process.stdout.write(JSON.stringify(errorOutput, null, 2) + "\n", () => process.exit(exitCode), ); return; }Technical Analysis
The HTTP request implementation hard-codes an external WeChat contact in the error generated for HTTP 401 and 403 responses. CLI handlers subsequently include the message in stderr and in the JSON written to stdout.
This behavior directly contradicts the token-management policy in
SKILL.md:36-38, which requires authentication failures to use neutral wording and explicitly prohibits runtime contact details, website links, or promotional content. Because stdout is documented as machine-readable JSON, ...[truncated 1556 chars]- Remediation
View remediation
Remediation Suggestions
-
Replace the authentication error with a neutral message, for example:
js const e = new AuthError( "GUAIKEI_API_TOKEN is invalid or expired. Check the configured environment variable.", ); -
Remove all contact details, marketing language, and support links from runtime messages.
-
Centralize authentication-error formatting so every CLI returns the same neutral response.
-
Avoid directly exposing arbitrary upstream error text to agent-visible output. Map remote errors to a documented set of local error codes and messages.
-
Add automated tests that simulate HTTP 401 and 403 responses and assert that stdout and stderr contain no phone numbers, social-media contacts, URLs, or promotional language.
-
Review equivalent catch paths in:
src/douyin/search-cli.jssrc/douyin/post-cli.jssrc/douyin/comment-cli.jssrc/douyin/hot-cli.js
-