T01 · Skill Instruction Hijacking
- Location
src/utils/token.js:23- Finding
Runtime Authentication Errors Inject Undisclosed Promotional and Contact Messaging
- Content
View full analysis
Vulnerability Details
File Location:
src/utils/token.js:23-29;src/utils/request.js:50-57; contradictory security requirement inSKILL.md:31-39
Vulnerability Type: Runtime output manipulation and violation of declared skill behavior
Risk Level: MediumEvidence
The skill explicitly states that invalid-token errors must be neutral and must not include contact details, website links, or promotional language:
text ## ⚠️ 令牌管理规范 令牌无效时**仅输出中性错误**，不输出联系方式、官网链接或营销话术。 ✅ GUAIKEI_API_TOKEN 未配置或格式无效，技能已暂停。 请检查环境变量 GUAIKEI_API_TOKEN 是否已设置有效令牌。 ❌ 禁止：输出微信/官网链接/营销话术（"一键解锁""早配置早享受"等）However, the missing or malformed token path prints a promotional website:
javascript function skillToken(token) { if (!isValidToken(token)) { utils.printWarn("警告: 你的 GUAIKEI_API_TOKEN 未正确配置,技能已暂停. "); utils.printSuccess("\t快速获取通道: www.guaikei.com"); return ""; }The HTTP authentication failure path also embeds a telephone/WeChat contact in the exception:
javascript } else if (res.statusCode === 401 || res.statusCode === 403) { const e = new AuthError( "GUAIKEI_API_TOKEN 无效, 请检查环境变量 或 联系微信: 13395823479 获取解决方案", ); e.noRetry = true; reject(e); }Technical Analysis
The executable implementation contradicts the skill's declared safety and token-management policy. Users and agents reviewing
SKILL.mdare told that authentication failures produce only neutral diagnostic messages, while both invalid-token paths inject acquisition or contact messaging at runtime.The server-controlled authentication path is particularly significant. A
401or403response fromwww.guaikei.comcauses the hard-coded contact message to be placed in anAuthError. CLI entry points subsequently copyerror.messageinto the JSON response written to standard output and print it through the logging utility. Consequently, the promotional content can enter both human ...[truncated 1757 chars]- Remediation
View remediation
Remediation Suggestions
-
Replace all invalid-token output with the neutral message promised by
SKILL.md. -
Remove the website from
src/utils/token.jsand the telephone/WeChat contact fromsrc/utils/request.js. -
Use a stable machine-readable error such as:
javascript new AuthError( "GUAIKEI_API_TOKEN is missing, invalid, or rejected. Check the configured environment variable.", ); -
Keep token acquisition information exclusively in
readme.md, as the skill policy declares. -
Add automated tests covering:
- Missing tokens.
- Malformed tokens.
- HTTP
401responses. - HTTP
403responses. - JSON standard output and standard-error output.
-
Make the tests fail if runtime authentication errors contain URLs, telephone numbers, social-media contacts, or acquisition language.
-
Review every user-visible error supplied by the remote service before forwarding it to agent output. Prefer locally defined neutral messages for authentication and authorization failures.
-