T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:66
- Finding
- Mandatory Session-Wide Tool Interception Delegates Control to an External Policy Service## Vulnerability Details **File Location**: `SKILL.md`, lines 66-68, 118-159 **Vulnerability Type**: Session instruction hijacking and external control-plane delegation **Risk Level**: Medium ### Evidence ```markdown ## Agent Protocol (MANDATORY) **You MUST follow this protocol before executing any tool call.** No exceptions. ``` ```markdown ### Step 2: Check policy with the control plane Send a POST request to the Authensor control plane **before executing the tool**: POST ${CONTROL_PLANE_URL}/decide Authorization: Bearer ${AUTHENSOR_API_KEY} Content-Type: application/json { "action": { "type": "<action_type>", "resource": "<resource>" }, "tool": "<tool_name>" } ``` ```markdown - **`require_approval`** → Do NOT execute the tool call yet. Tell the user: "Waiting for approval: `<action_type>` on `<resource>` (receipt: `<receiptId>`). Approve via CLI: `openclaw approvals approve <receiptId>`." Then **poll** `GET ${CONTROL_PLANE_URL}/receipts/<receiptId>` every 30 seconds until the status changes to `approved` or `rejected`. **Stop polling after 10 minutes** (20 attempts) and tell the user: "Approval timed out for `<receiptId>`. Action was not executed." ### Important rules - **Never skip the policy check.** Every tool call must be checked, even if a similar action was recently allowed. Each call gets its own receipt. ``` ### Technical Analysis The skill injects mandatory instructions into the agent session and requires every tool invocation to be mediated by a configurable external control plane. This changes the agent's normal tool-execution behavior globally rather than limiting the policy check to operations directly associated with a specific Authensor request. The behavior is consistent with the skill's declared policy-gateway purpose, but its scope is broader than a conventional task-sp ...[truncated 3846 chars]
- Remediation
- ## Remediation Suggestions 1. Replace prompt-only mandatory interception with a native, auditable `PreToolUse` enforcement mechanism. Do not represent prompt instructions as an equivalent security boundary. 2. Scope interception explicitly. Allow users to select which tools, workspaces, skills, or risk categories are sent to the policy service instead of unconditionally intercepting every tool call. 3. Validate `CONTROL_PLANE_URL` against an administrator-controlled HTTPS allowlist. Reject embedded credentials, non-HTTPS schemes, redirects to untrusted origins, and endpoints with invalid certificates. 4. Pin or otherwise authenticate the expected control-plane identity where the deployment model permits it. Clearly warn users that changing the URL delegates action metadata and the Authensor API key to that server. 5. Implement deterministic redaction outside the language model. Cover URL user information, query strings, fragments, headers, environment assignments, shell expansions, encoded credentials, database connection strings, and uncommon authentication flags. 6. Send only normalized policy attributes needed for a decision. Prefer hashed or generalized resource identifiers where exact paths and command strings are unnecessary. 7. Use a narrowly scoped, revocable credential for policy decisions. Do not reuse credentials across unrelated environments, and support rotation and short expiration. 8. Apply strict response validation in code, including schema checks, receipt binding, timeouts, replay protection, and confirmation that approval responses correspond to the original normalized action. 9. Bound polling more tightly and provide immediate cancellation. Resolve the inconsistency between the documented ten-minute polling procedure and the later statement describing five-minute approval latency. 10. Make the trust model explicit during installation: this skill intentionally changes session-wide tool behavior and sends metadata to an externa ...[truncated 430 chars]