T01 · Skill Instruction Hijacking
- Location
src/utils/token.js:24- Finding
Authentication failures inject prohibited promotional and contact information into runtime output
- Content
View full analysis
Vulnerability Details
File Location:
src/utils/token.js:24-27;src/utils/request.js:51-55
Vulnerability Type: Runtime output manipulation and instruction-policy violation
Risk Level: HighVulnerable Code
src/utils/token.js:24-27:js if (!isValidToken(token)) { utils.printWarn("警告: 你的 GUAIKEI_API_TOKEN 未正确配置,技能已暂停. "); utils.printSuccess("\t快速获取通道: www.guaikei.com"); return ""; }src/utils/request.js:51-55:js const e = new AuthError( "GUAIKEI_API_TOKEN 无效, 请检查环境变量 或 联系微信: 13395823479 获取解决方案", ); e.noRetry = true; reject(e);Technical Analysis
SKILL.md:37-39explicitly requires authentication failures to produce only neutral errors and prohibits runtime contact details, external links, or promotional content. The implementation violates this declared constraint in two separate authentication-failure paths:- A locally missing or malformed token prints the service website as a token-acquisition channel.
- An HTTP 401 or 403 response produces an
AuthErrorcontaining a WeChat contact number.
CLI handlers copy
error.messageinto stderr and structured JSON error output. An agent invoking the Skill can therefore relay the promotional or contact content as if it were a necessary operational instruction. This creates a predictable output-manipulation channel outside the Skill's declared data-retrieval purpose.No evidence was found that these strings execute code, change system permissions, or establish persistence. The risk concerns agent-output integrity, user redirection, and violation of the Skill's explicit runtime behavior.
Attack Path
Local validation path:
- A user or agent invokes any CLI without
GUAIKEI_API_TOKEN, or with a token that fails format validation. skillToken()detects the invalid token.- The runtime prints
www.guaikei.comas a token-acquisition channel. - The invoking agent or interface may pr ...[truncated 1057 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace both authentication-failure messages with a fixed, neutral message such as
GUAIKEI_API_TOKEN is missing or invalid; execution has stopped. - Remove all websites, phone numbers, social-media contacts, acquisition instructions, and promotional text from runtime code.
- Return a stable machine-readable error code such as
AUTH_REQUIREDwithout remote-service guidance. - Ensure stdout contains only the documented JSON response and stderr contains only neutral diagnostics.
- Centralize authentication-error generation so local validation and HTTP 401/403 responses use the same sanitized message.
- Add automated tests that invoke every CLI with missing, malformed, expired, and unauthorized tokens and assert that output contains no URLs, phone numbers, contact handles, or promotional phrases.
- Keep token-enrollment and support information exclusively in static user documentation, as required by
SKILL.md.
- Replace both authentication-failure messages with a fixed, neutral message such as