T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:47- Finding
Indirect Prompt Injection Through Untrusted Operational Logs
- Content
View full analysis
&1 | tail -100) EVOLVER_LOG="" LATEST_EVOLVER=$(ls -t /tmp/evolver-*.log 2>/dev/null | head -1) if [ -n "$LATEST_EVOLVER" ]; then EVOLVER_LOG=$(tail -50 "$LATEST_EVOLVER") fi PROMPT="You are the private secretary. Build a concise daily brief with: 1) system status 2) what happened today 3) issues found 4) resolved vs unresolved 5) items requiring executive attention System logs: ${LOGS} Evolution report: ${EVOLVER_LOG}" ``` ### Technical Analysis The documented workflow directly interpolates gateway and evolver log contents into an instruction-bearing prompt. No clear trust boundary, structured encoding, content sanitization, or instruction is provided to require the agent to treat the appended logs strictly as untrusted data. Operational logs can contain attacker-controlled content originating from requests, error messages, agent responses, plugin output, or other runtime inputs. An attacker can therefore place natural-language instructions in a source that is later written to one of the collected logs. When the scheduled brief runs, those instructions become part of the prompt supplied to the `secretary` agent. Because the trusted reporting instructions and untrusted log content occupy the same prompt context, the model may interpret injected log text as instructions rather than evidence to summarize. Merely serializing the final prompt with `jq -Rs` protects JSON syntax but does not mitigate semantic prompt injection. ### Attack Path 1. An attacker identifies an input that is recorded in the `openclaw-gateway` logs or the latest `/tmp/evolver-*.log`. 2. The attacker submits content containing instructions such as asking the secretary to ignore the reporting format, conceal incid ...[truncated 1294 chars]- Remediation
View remediation