T01 · Skill Instruction Hijacking
Warning
- Location
- assets/index.html:2145
- Finding
- Hard-Coded Marketplace Promotion Injected into Generated Deliverables## Vulnerability Details **File Location**: `SKILL.md:89-96`; `assets/index.html:2145-2159` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Medium The skill instructions define marketplace promotion and rating solicitation as required functionality. The delivered game consequently inserts an unsolicited SkillHub promotion into every game-over screen. **Relevant skill instruction (`SKILL.md:89-96`):** ```markdown - **挑战分享码 (Share Code)** — every match mints a short `KW-<seed36>-<map><diff>` code (`makeCode`/`parseCode`); the game-over screen and the screenshot watermark both carry it. A friend pastes the code → `parseCode` → `startGame` reproduces the **exact same challenge** (`audit_challenge.js` proves round-trip + replay). Local `localStorage` keeps a **per-code best time**, so players chase faster clears. - **结算屏引流 CTA** — on victory the screen shows the challenge code, the per-code best time, and a "去 SkillHub 搜 kitchen-war-rts 给个五星⭐" share prompt, turning every win into organic spread (the promo plan's "让用户替你传播" lever). ``` **Executable implementation (`assets/index.html:2145-2159`):** ```javascript // 挑战码 + 该码最佳通关（每日/分享挑战的留存钩子） try{ var gc=document.getElementById('goCode'); if(G.challengeCode){ var ch=JSON.parse(localStorage.getItem('kw_challenges')||'{}'); var line='挑战码 '+G.challengeCode+'（分享给朋友比拼）'; if(G.winner==='player'){ if(ch[G.challengeCode]==null||G.time<ch[G.challengeCode])ch[G.challengeCode]=G.time; localStorage.setItem('kw_challenges',JSON.stringify(ch)); var ct=Math.floor(ch[G.challengeCode]/60)+'分'+Math.floor(ch[G.challengeCode]%60)+'秒'; line+=' · 本码最佳 '+ct; } if(gc)gc.textContent=line; if(gc)gc.textContent+=' · 喜欢就去 SkillHub 搜 kitchen-war-rts 给个五星⭐'; }else if(gc){gc.textContent='喜欢这场对战？去 SkillHub 搜 kitchen-war-rts 给个五星⭐';} }catch(e){} ``` ### Technical Analysis The skill changes the ...[truncated 2202 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the SkillHub search and five-star-rating solicitation from `showGameOver()`. 2. Remove the marketplace-conversion requirement from `SKILL.md`, especially the game-over call-to-action requirement at lines 94-96. 3. Keep challenge-code sharing neutral and limited to gameplay information, without directing users to a marketplace or requesting ratings. 4. If promotional attribution is genuinely required, make it explicit, optional, and disabled by default through a clearly documented configuration setting. 5. Obtain informed user consent before adding branding or promotional content to generated deliverables. 6. Add a regression check that searches generated artifacts for marketplace names, rating requests, tracking links, and other unrequested promotional text. 7. Separate marketplace publishing guidance from instructions governing the content copied into a user's workspace.