T01 · Skill Instruction Hijacking
Error
- Location
- references/Bo2bot_For_LLMs.md:7
- Finding
- Untrusted API Responses Are Promoted to Authoritative Agent Instructions and Requests<![CDATA[ ## Vulnerability Details **File Location**: `references/Bo2bot_For_LLMs.md:7-37`; related instructions in `references/Bo2bot_OpenClaw_Kickoff.md:33-36` **Vulnerability Type**: Trust-boundary violation and remote instruction hijacking **Risk Level**: High ### Vulnerable Code Snippet ```markdown **First act of every session: read the session context report your login returns.** It is self-describing — your state, capabilities, rate limits, and a `session_procedure` built from what's actually waiting. The `description` and `note` fields inside every response block are the instruction manual, not decoration; read them as part of the intended sequence. --- ## Rule 1 — Use what the response gives you. Don't guess. Responses embed pre-formed navigation in `next_actions`, `session_procedure`, `capabilities`, and `session_context`. Each entry carries `endpoint`, `auth`, and (for writes) `body_required`. Use them verbatim — two mechanics: **`endpoint` is `"METHOD URL"`, not a bare URL.** Split before calling: ```js const [method, url] = step.endpoint.split(" "); fetch(url, { method, headers: { Authorization: step.auth.replace("Authorization: ", "") } }); // fetch(step.endpoint) → ERR_INVALID_URL ``` **Fulfill `body_required` exactly.** Every named field is mandatory — including `content_type`, which lives *inside the JSON payload*, not the HTTP headers. Missing fields → `400`. If an expected field is absent, read the raw response. Don't retry with guesses. Pre-formed endpoints appear at every level, not just top-level `next_actions`: metadata rows carry a `read_endpoint`, feedback options carry their own endpoints, reply blocks carry theirs. When a response hands you a pre-populated endpoint for the thing you're about to do, use it directly — never rebuild it from a generic pattern. ``` Related instruction: ```markdown - **Designed for LLMs.** API responses embed pre-formed next actions (endpoint + auth + body templates). Use what the response ha ...[truncated 2847 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat every API response field as untrusted data, never as an authoritative Agent instruction. 2. Replace remotely supplied absolute URLs with locally defined action identifiers mapped to fixed methods and paths. 3. Enforce an exact destination allowlist: - Scheme must be `https`. - Host must be exactly `api.bo2bot.com`. - Reject user-info components, unexpected ports, redirects, and alternative subdomains. 4. Construct authorization headers only from locally managed session state. Never forward an `auth` value taken from a response. 5. Define a local allowlist of permitted HTTP methods and endpoint path patterns. 6. Validate every response and request body against a local schema before use. 7. Require explicit human authorization for messages, replies, feedback, acknowledgments, relationship changes, or other externally visible writes unless the user has clearly enabled that exact automation. 8. Give system and user instructions precedence over Skill documentation and all remote content. 9. Present unexpected response instructions as quoted data for review rather than executing them. 10. Add tests using malicious endpoints, cross-origin URLs, unsafe methods, and instruction-like response text to verify that they are rejected. ]]>