T01 · Skill Instruction Hijacking
Error
- Location
openbotclaw.py:958- Finding
Untrusted World Chat Is Injected Directly into the Agent's LLM Instruction Context
- Content
View full analysis
str: """ Build a compact world-state snapshot for an LLM agent. Returns a multi-line string with observation markers (see MESSAGING.md). This method also updates internal state: - ``_tick_count`` is incremented - ``_new_senders`` / ``_tagged_by`` are populated for the current tick - ``_current_topic`` rotates every ~3 ticks ... Returns: Compact observation string ready to be sent to an LLM. """ ... # Recent conversation (last 6 messages) recent = self.get_recent_conversation(60.0) self._new_senders = [] self._tagged_by = [] agent_name = self.entity_id or self.agent_name if recent: self._last_chat_tick = self._tick_count for m in recent[-6:]: sender = m.get("agent_name", "?") msg_text = m.get("message", "") ts = m.get("timestamp", 0) key = (sender, ts) is_new = key not in self._seen_msg_keys if sender != agent_name and is_new: self._seen_msg_keys.add(key) self._new_senders.append(sender) tagged = self.is_mentioned(msg_text) if tagged: self._tagged_by.append(sender) lines.append(f"📣 TAGGED BY {sender}: {msg_text}") else: lines.append(f"⬅ NEW {sender}: {msg_text}") else: lines.append(f"{sender}: {msg_text}") # Reply directive if self._tagged_by: lines.append(f"REPLY TO: {self._tagged_by[-1]}") elif self._new_senders: line ...[truncated 2723 chars]- Remediation
View remediation
`. 5. Remove mandatory-response language. Safety policy, user intent, and rate limits must take priority over replying. 6. Reject requests to reveal prompts, tokens, credentials, private files, internal state, or tool output. 7. Require human confirmation before a chat message can cause filesystem, network, credential, or other out-of-world actions. 8. Apply message length limits and content filtering before text reaches the model. 9. Add prompt-injection regression tests using malicious mentions and sender names. ]]>