T01 · Skill Instruction Hijacking
Error
- Location
references/hooks-config.md:52- Finding
Public Webhook Requests Can Become Privileged Full-Agent Turns
- Content
View full analysis
", "path": "/hooks", "defaultSessionKey": "hook:relay", "allowRequestSessionKey": false, "allowedAgentIds": ["main"], "allowedSessionKeyPrefixes": ["hook:"], "transformsDir": "/.openclaw/hooks/transforms", "mappings": [ { "id": "agent-relay", "match": { "path": "agent-relay" }, "action": "agent", "agentId": "main", "wakeMode": "now", "name": "Agent Relay", "sessionKey": "hook:relay", "messageTemplate": "--- Message from User via Relay ({{message.id}}) ---\n{{message.text}}\n--- End relay ---\n\nProcess this as a full agent turn. Reply with:\n relay send \"\"\n\nETIQUETTE: Short (1-3 lines), direct, no fluff, no sign-offs.", "deliver": false, "transform": { "module": "agent-relay.mjs" } } ] } } ``` ```nginx handle /hooks/* { reverse_proxy localhost:18789 { header_up Authorization "Bearer " } } ``` ```js return { message: [ `--- Message from User via Relay (${msg.id || ""}) ---`, parts.join("\n"), "--- End relay ---", "", "Process this as a full agent turn. Reply via:", ' /skills/agent-relay/scripts/relay send ""', "", "ETIQUETTE: Short (1-3 lines), direct, no fluff, no sign-offs.", ].join("\n"), }; ``` ### Technical Analysis The recommended reverse-proxy configuration overwrites the `Authorization` header with a valid hook bearer token for every request under `/hooks/*`. Authentication therefore proves only that the request passe ...[truncated 2055 chars]- Remediation
View remediation