T01 · Skill Instruction Hijacking
Error
- Location
scripts/analyze.py:76- Finding
Indirect Prompt Injection Through Scraped AlphaPai Content
- Content
View full analysis
str: target_length = int(settings["ai"]["target_length_chars"]) custom_requirements = str(settings["ai"].get("custom_requirements") or "").strip() custom_block = "" if custom_requirements: custom_block = f"\n额外格式要求：\n{custom_requirements}\n" return f"""你是一位擅长二级市场信息提炼的研究员，请把 Alpha派最近 {lookback_hours:g} 小时评论整理成一份适合手机阅读的中文摘要。 必须遵守以下格式和要求： 1. 总字数控制在 {target_length - 100} 到 {target_length + 150} 字。 ... 下面是原文： {content} """ def run_ai_analysis(prompt: str, settings: dict[str, Any]) -> str | None: model = settings["ai"]["model"] try: result = subprocess.run( [ "openclaw", "agent", "--message", prompt, "--model", model, ], capture_output=True, text=True, timeout=180, ) ``` ### Technical Analysis Content obtained from AlphaPai is interpolated verbatim into an instruction-bearing prompt and passed to `openclaw agent`. The prompt does not establish a strong trust boundary, identify the appended content as untrusted data, or instruct the model to ignore directives contained in that data. The historical-query path also calls `run_ai_analysis()` from `scripts/query_comments.py:146`, so previously archived attacker-controlled content can trigger the same condition. ### Attack Path 1. An attacker publishes an AlphaPai comment containing instructions directed at an AI model. 2. An authenticated user runs the scraper or searches an archive containing that comment. 3. The application inserts the comment directly into the prompt. 4. `openclaw agent` processes the embedded instructions ...[truncated 487 chars]- Remediation
View remediation