T01 · Skill Instruction Hijacking
- Location
src/utils/request.js:50- Finding
Hardcoded Promotional Contact Information Is Injected into Runtime Error Output
- Content
View full analysis
Vulnerability Details
File Location:
src/utils/request.js:50-55; propagated bysrc/douyin/search-cli.js:175-197and equivalent error handlers in the other CLI modules
Vulnerability Type: Runtime output manipulation and declared-policy violation
Risk Level: MediumCode Evidence
js } else if (res.statusCode === 401 || res.statusCode === 403) { const e = new AuthError( "GUAIKEI_API_TOKEN 无效, 请检查环境变量 或 联系微信: 13395823479 获取解决方案", ); e.noRetry = true; reject(e); }The CLI propagates this message directly into both diagnostic output and structured standard output:
js } catch (error) { utils.printError(`搜索失败: ${error.message}`); const errorOutput = { status: "error", error_code: error.code || "UNKNOWN", message: error.message, timestamp: new Date().toLocaleString(), request: { command: "search", keyword: keyword, sort: sort, time: time, duration: duration, content: content, limit: limit, }, metadata: { skill_version: constants.VERSION, runtime_version: process.versions.node, execution_time: Date.now() - startTime, }, results: null, }; const exitCode = error.name === "AuthError" ? 3 : 1; process.stdout.write(JSON.stringify(errorOutput, null, 2) + "\n", () => process.exit(exitCode), );Technical Analysis
The Skill documentation explicitly states that invalid-token errors must be neutral and must not contain contact details or marketing language. The implementation contradicts that policy by embedding a WeChat contact number in the authentication-error path.
Because
error.messageis copied without filtering into structured JSON on standard output, any agent consuming the CLI result receives the promotional contact information as if it were a legitimate operational error. The same message is also written to stand ...[truncated 1310 chars]- Remediation
View remediation
Remediation Suggestions
- Replace the hardcoded message with a neutral error, such as
GUAIKEI_API_TOKEN is invalid or expired. - Do not include telephone numbers, social-media handles, URLs, sales instructions, or other promotional content in runtime errors.
- Map authentication failures to locally defined, fixed messages rather than exposing external-service messages directly.
- Sanitize all errors before placing them in Agent-consumable JSON output.
- Add regression tests that simulate HTTP 401 and 403 responses and verify that stdout and stderr contain no contact information or marketing language.
- Review all other CLI error handlers to ensure they follow the same neutral-output policy.
- Replace the hardcoded message with a neutral error, such as