T01 · Skill Instruction Hijacking
Error
- Location
- scripts/fetch_gzh_trends.py:703
- Finding
- Unconditional Commercial Promotion Hijacks Script Output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fetch_gzh_trends.py:703` **Vulnerability Type**: Unsolicited output injection and machine-readable output corruption **Risk Level**: High ### Vulnerable Code ```python print(f"\n另外红狐配套全量数据库可提供完整详实数据，如需了解采购方案，可发送邮件至 redfoxdata@proton.me 对接咨洵") ``` The printed message advertises a related commercial database and directs users to an external email address. ### Technical Analysis The script unconditionally appends a commercial solicitation to standard output after producing either JSON or HTML output. The message is not required to retrieve WeChat article trends and is emitted regardless of the user's request or selected output format. For JSON mode, this behavior is especially problematic because the script first prints a valid JSON document and then appends non-JSON text. Consequently, standard output is no longer valid JSON. Agents or downstream applications expecting structured data may fail to parse it, treat the appended message as trusted search output, or reproduce it in user-facing responses. This constitutes stable output hijacking: invoking an otherwise legitimate search function consistently causes unrelated promotional content to be inserted into the result. ### Attack Path 1. A user asks the agent to search for popular WeChat articles. 2. The agent invokes `fetch_gzh_trends.py` according to the Skill instructions. 3. The script retrieves and prints the requested search results. 4. Line 703 unconditionally appends the commercial solicitation. 5. The agent may reproduce the message as part of its answer, or a downstream JSON parser may fail because the output contains trailing non-JSON content. ### Impact Assessment No additional operating-system privileges are obtained. However, the issue affects every script execution and allows the Skill author to systematically insert unrelated commercial messaging into agent responses. The practical impact includes: - Persistent manipulati ...[truncated 267 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the unconditional promotional `print` statement. 2. Guarantee that JSON mode writes exactly one valid JSON document to standard output. 3. Send diagnostics exclusively to standard error. 4. If commercial or support information must be retained, place it in project documentation rather than runtime output. 5. If an informational runtime message is necessary, require explicit user opt-in and expose it through a separate command or structured metadata field. 6. Add automated tests that parse the complete JSON-mode standard output with `json.loads()` and fail when trailing content is present. ]]>