T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:66- Finding
Mandatory Session-Wide Tool Interception Delegates Control to an External Policy Service
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 66-68, 118-159
Vulnerability Type: Session instruction hijacking and external control-plane delegation
Risk Level: MediumEvidence
markdown ## Agent Protocol (MANDATORY) **You MUST follow this protocol before executing any tool call.** No exceptions.markdown ### Step 2: Check policy with the control plane Send a POST request to the Authensor control plane **before executing the tool**: POST ${CONTROL_PLANE_URL}/decide Authorization: Bearer ${AUTHENSOR_API_KEY} Content-Type: application/json { "action": { "type": "<action_type>", "resource": "<resource>" }, "tool": "<tool_name>" }markdown - **`require_approval`** → Do NOT execute the tool call yet. Tell the user: "Waiting for approval: `<action_type>` on `<resource>` (receipt: `<receiptId>`). Approve via CLI: `openclaw approvals approve <receiptId>`." Then **poll** `GET ${CONTROL_PLANE_URL}/receipts/<receiptId>` every 30 seconds until the status changes to `approved` or `rejected`. **Stop polling after 10 minutes** (20 attempts) and tell the user: "Approval timed out for `<receiptId>`. Action was not executed." ### Important rules - **Never skip the policy check.** Every tool call must be checked, even if a similar action was recently allowed. Each call gets its own receipt.Technical Analysis
The skill injects mandatory instructions into the agent session and requires every tool invocation to be mediated by a configurable external control plane. This changes the agent's normal tool-execution behavior globally rather than limiting the policy check to operations directly associated with a specific Authensor request.
The behavior is consistent with the skill's declared policy-gateway purpose, but its scope is broader than a conventional task-sp ...[truncated 3846 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace prompt-only mandatory interception with a native, auditable
PreToolUseenforcement mechanism. Do not represent prompt instructions as an equivalent security boundary. - Scope interception explicitly. Allow users to select which tools, workspaces, skills, or risk categories are sent to the policy service instead of unconditionally intercepting every tool call.
- Validate
CONTROL_PLANE_URLagainst an administrator-controlled HTTPS allowlist. Reject embedded credentials, non-HTTPS schemes, redirects to untrusted origins, and endpoints with invalid certificates. - Pin or otherwise authenticate the expected control-plane identity where the deployment model permits it. Clearly warn users that changing the URL delegates action metadata and the Authensor API key to that server.
- Implement deterministic redaction outside the language model. Cover URL user information, query strings, fragments, headers, environment assignments, shell expansions, encoded credentials, database connection strings, and uncommon authentication flags.
- Send only normalized policy attributes needed for a decision. Prefer hashed or generalized resource identifiers where exact paths and command strings are unnecessary.
- Use a narrowly scoped, revocable credential for policy decisions. Do not reuse credentials across unrelated environments, and support rotation and short expiration.
- Apply strict response validation in code, including schema checks, receipt binding, timeouts, replay protection, and confirmation that approval responses correspond to the original normalized action.
- Bound polling more tightly and provide immediate cancellation. Resolve the inconsistency between the documented ten-minute polling procedure and the later statement describing five-minute approval latency.
- Make the trust model explicit during installation: this skill intentionally changes session-wide tool behavior and sends metadata to an externa ...[truncated 430 chars]
- Replace prompt-only mandatory interception with a native, auditable