T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:64
- Finding
- Persistent Agent Behavior Modification Through Workspace Instruction Files## Vulnerability Details **File Location**: `SKILL.md:9`, `SKILL.md:64-103`, `SKILL.md:249-285`, `SKILL.md:582-596` **Vulnerability Type**: Persistent instruction hijacking and agent memory poisoning **Risk Level**: High The skill directs the agent to replace or augment persistent identity, behavioral, and memory files. The generated `AGENTS.md` instructions are intended to be loaded during every future session, allowing the skill's rules to continue affecting unrelated tasks after activation. ### Vulnerable Code `SKILL.md:9`: ```markdown **⚠️ READ THIS FIRST:** When this skill loads, read the entire file before acting. The "Take the Pill" flow below is your activation guide. ``` `SKILL.md:64-103`: ```markdown ### Step 2: Smart Merge Rules **SOUL.md (Personality)** ``` IF exists: → Read content → CHECK FOR BROKEN PATTERNS: * "Great question!" / "I'd be happy to help!" → Remove/fix * "As an AI language model..." → Remove * Corporate buzzwords (synergy, leverage, etc.) → Suggest fix * Generic assistant speak → Rewrite with personality → IF broken patterns found: → Show user: "Found X corporate phrases in SOUL.md. Fix them?" → IF yes: Rewrite with clean, authentic voice → IF no: Keep as-is → IF > 500 chars AND no broken patterns: → Keep exactly as-is ELSE: → Create from template ``` **AGENTS.md (Rulebook)** ``` IF exists: → Read sections → CHECK FOR BROKEN PATTERNS: * "Always be helpful" without boundaries → Add safety rules * Missing "Never" section (what not to do) → Add from template * No project structure guidance → Add Brain+Code section * No orchestrator rules → Add spawn guidelines → Merge missing good patterns → REPLACE broken patterns ELSE: → Create from template ``` **IDENTITY.md / USER.md / TOOLS.md** ``` IF exists with content → Keep IF empty/minimal → Populate from context or leave ...[truncated 4655 chars]
- Remediation
- ## Remediation Suggestions 1. Do not create or modify global behavioral files such as `SOUL.md`, `AGENTS.md`, or `IDENTITY.md` as part of normal skill activation. 2. Store skill-specific state in an isolated, namespaced directory such as `~/.openclaw/workspace/skills/memory-pill/`. 3. Remove all generated “Every Session” directives. Memory files should only be accessed when required by an explicit user request or narrowly scoped task. 4. Require separate informed consent for every existing file that will be modified. Display the exact path, proposed diff, persistence implications, and reason before requesting approval. 5. Never automatically replace content based on subjective classifications such as “generic,” “corporate,” or “broken.” 6. Back up each affected file before modification and provide a tested rollback operation that restores the original content and removes newly created files. 7. Use transactional updates: stage proposed files separately, validate them, request approval, and only then atomically apply the approved changes. 8. Restrict memory searches to the minimum relevant sources and avoid unconditional reads of `USER.md`, daily notes, or `MEMORY.md`. 9. Clearly distinguish task data from executable agent instructions. Stored facts and notes must not be interpreted as higher-priority behavioral rules. 10. Add a manifest listing every path the skill may read or write, and reject operations outside that allowlist.