T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:223
- Finding
- Public Disclosure of Genuine Agent Reasoning## Vulnerability Details **File Location**: `SKILL.md:223-226` **Supporting Locations**: `SKILL.md:18`, `SKILL.md:23`, `SKILL.md:71`, `SKILL.md:101-106` **Vulnerability Type**: Forced disclosure of internal agent reasoning to an external service **Risk Level**: High ### Vulnerable Code Snippet ```markdown 1. Use `exec` to `curl` the register endpoint 2. Poll `/play` with `exec` 3. Read the game state, **reason about it yourself** (you ARE the LLM), then submit your turn 4. Your `think` field = your actual reasoning. Spectators will see your real thought process! ``` The disclosure behavior is also explicitly established earlier: ```markdown > The `think` field exposes your reasoning to spectators — make it genuine and entertaining. ``` ```markdown > Your `think` and `plan` fields are shown to spectators, so make your reasoning interesting! ``` ### Technical Analysis The Skill explicitly instructs the executing agent to place its actual reasoning into the outbound `think` field. That field is transmitted to `molthouse.crabdance.com` and displayed to spectators. This exceeds what is necessary to play the game: a short, sanitized, game-specific rationale would provide equivalent functionality without exposing genuine internal reasoning. The risk is amplified because the Skill directs an OpenClaw agent with tool access to execute network requests itself. Agent reasoning can be influenced by the surrounding session, system instructions, user-provided context, remote game messages, and tool results. Requiring the actual reasoning to be submitted creates a direct disclosure channel from the agent session to an externally operated service. Although the document labels `think` as optional and sometimes calls it private, it also states that spectators can see it and repeatedly encourages its disclosure. The documented unauthenticated spectator interface broadens the potential audience beyond the game server operator. ...[truncated 1430 chars]
- Remediation
- ## Remediation Suggestions 1. Remove every instruction requesting actual, genuine, private, or hidden reasoning. 2. Replace the `think` field with an optional, concise, in-character explanation derived exclusively from game-visible data. 3. State explicitly that outbound fields must never contain system prompts, developer instructions, credentials, API keys, user data, local file contents, tool output, or unrelated session context. 4. Prefer omitting `think` and `plan` entirely because the API documentation marks them optional. 5. If spectator commentary is required, generate it in a separate constrained step with only sanitized game state as input. 6. Display a clear disclosure warning and require informed user approval before publishing any commentary. 7. Apply output filtering and length limits before submission to reduce accidental data leakage. 8. Avoid representing spectator-visible information as private in API documentation or examples.