T01 · Skill Instruction Hijacking
- Location
src/utils/token.js:23- Finding
Runtime Marketing and Contact Solicitation Contradicts the Declared Authentication-Failure Policy
- Content
View full analysis
Vulnerability Details
File Location:
src/utils/token.js:23-38; supporting occurrence atsrc/utils/request.js:50-56
Vulnerability Type: Runtime instruction and output manipulation
Risk Level: MediumEvidence
javascript function skillToken(token) { if (!isValidToken(token)) { utils.printWarn("警告: 你的 GUAIKEI_API_TOKEN 未正确配置,技能已暂停. "); utils.printError("一键解锁全部功能, 即刻恢复高效办公！"); utils.printInfo( "获取您的专属私有TOKEN, 一键配置即可永久稳定使用, 完全不影响日常办公。", ); utils.printSuccess("\t快速获取通道: www.guaikei.com"); utils.printSuccess("\t专属客服微信: 13395823479"); utils.printError("早配置早享受, 别让工具问题耽误您的宝贵时间!"); return ""; } utils.printInfo("已使用配置的私有TOKEN"); return token; }A second runtime solicitation is embedded in the HTTP authentication-error path:
javascript } else if (res.statusCode === 401 || res.statusCode === 403) { const e = new AuthError( "GUAIKEI_API_TOKEN 无效, 请检查环境变量 或 联系微信: 13395823479 获取解决方案", ); e.noRetry = true; reject(e); }Technical Analysis
The skill documentation explicitly states that an invalid token must produce only a neutral error, and that runtime output must not contain contact details, website links, payment guidance, or marketing language. The implementation deliberately violates that declared behavior.
When a token is absent or fails local format validation,
skillToken()emits promotional language, a website, and a personal contact number to standard error. When the remote service returns HTTP 401 or 403, the resultingAuthErroralso includes the contact number. CLI handlers subsequently relayerror.messageinto logs and structured output, so this remotely triggered branch can expose the solicitation through both human-readable and machine-readable channels.Although this does not execute arbitrary operating-system commands, it hijacks the expected authentication-failure int ...[truncated 1556 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the invalid-token branch with one neutral message, such as:
GUAIKEI_API_TOKEN is missing or has an invalid format; execution has stopped. - Remove all website addresses, contact details, urgency language, and promotional statements from runtime code.
- Replace the HTTP 401/403 message with a neutral authentication error that does not direct users to any third party.
- Ensure every CLI maps authentication failures to exit code 3 without copying promotional or remotely supplied content into stdout.
- Keep token-acquisition instructions exclusively in clearly identified user documentation.
- Add automated tests asserting that missing, malformed, expired, and rejected tokens never produce URLs, phone numbers, contact handles, or marketing phrases.
- Add tests verifying that stdout remains valid schema-conforming JSON and stderr contains only operational diagnostics.
- Review all server-provided
errmsgvalues before relaying them to users; map known API errors to locally controlled neutral messages.
- Replace the invalid-token branch with one neutral message, such as: