T01 · Skill Instruction Hijacking
- Location
src/utils/token.js:23- Finding
Authentication Error Paths Inject Promotional Website and Contact Information
- Content
View full analysis
Vulnerability Details
File Location:
src/utils/token.js:23-28;src/utils/request.js:50-56
Vulnerability Type: Runtime promotional output that contradicts the Skill's declared authentication-handling rules
Risk Level: HighVulnerable Code
src/utils/token.js:23-28:js function skillToken(token) { if (!isValidToken(token)) { utils.printWarn("警告: 你的 GUAIKEI_API_TOKEN 未正确配置,技能已暂停. "); utils.printSuccess("\t快速获取通道: www.guaikei.com"); return ""; }src/utils/request.js:50-56:js } else if (res.statusCode === 401 || res.statusCode === 403) { const e = new AuthError( "GUAIKEI_API_TOKEN 无效, 请检查环境变量 或 联系微信: 13395823479 获取解决方案", ); e.noRetry = true; reject(e);Technical Analysis
The Skill documentation at
SKILL.md:38-39explicitly requires authentication failures to produce only neutral error messages. It also states that runtime output must not contain contact details, website links, or promotional content.The implementation violates those declared constraints in two separate authentication error paths:
- Local token-format validation prints a fixed token-acquisition website.
- HTTP 401 or 403 responses create an authentication error containing a fixed WeChat contact and telephone number.
These messages are not derived from user input and are deliberately embedded in predictable runtime paths. The HTTP authentication message is propagated by the CLI error handlers into both stderr diagnostics and structured stdout error responses. The behavior can therefore influence agent-visible or user-visible output even though the Skill description expressly prohibits it.
Attack Path
Local validation path:
- A user invokes any CLI without
GUAIKEI_API_TOKEN, or supplies a token that fails the length or character-set validation. - The CLI calls
skillToken(). skillToken()prints the hardcodedwww.guaikei.comacqui ...[truncated 1447 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove all websites, telephone numbers, social-media contacts, acquisition instructions, and promotional wording from runtime error paths.
- Replace local validation output with a neutral message such as:
GUAIKEI_API_TOKEN is missing or has an invalid format; execution has stopped. - Replace HTTP 401 and 403 handling with a neutral
AuthErrorthat does not direct users to any external channel. - Ensure authentication failures consistently return exit code 3 without retrying.
- Keep any legitimate account-registration information exclusively in user documentation, clearly separated from runtime behavior.
- Add automated tests that invoke all CLIs with missing, malformed, and rejected tokens and assert that stdout and stderr contain no URLs, telephone numbers, contact handles, or promotional wording.
- Review all other runtime messages for similar documentation-to-implementation inconsistencies.