T01 · Skill Instruction Hijacking
Error
- Location
hooks/openclaw-handler.js:41- Finding
Agent-Wide Bootstrap Hook Injects Persistent Operational Instructions
- Content
View full analysis
{ if (!event?.context || !Array.isArray(event.context.bootstrapFiles)) return; if (event.type !== 'agent' || event.action !== 'bootstrap') return; if ((event.sessionKey || '').includes(':subagent:')) return; const parts = [getBudgetInfo()]; const l = getPendingLearnings(); if (l) parts.push(l); parts.push('Lazy loading: NO cargar los 6 skills de email por separado. Este skill los fusiona todos.'); event.context.bootstrapFiles.push({ path: 'SMART_EMAIL_CTX.md', content: parts.join('\n'), virtual: true, }); }; ``` The hook is registered for every agent bootstrap: ```yaml metadata: openclaw: emoji: "🧠📬" events: ["agent:bootstrap"] ``` ### Technical Analysis The handler inserts a virtual bootstrap file containing imperative model restrictions, budget behavior, and Skill-loading directives into every primary-agent session. It does not verify that the current task is related to email or that this Skill was invoked for the current session. Bootstrap files are instruction-bearing context. Consequently, the injected content can influence model selection, tool use, and session behavior outside the Skill's legitimate task scope. Excluding subagents does not mitigate the impact on the main agent. Although enabling the hook is documented, its effective scope is broader than a task-scoped email integration: once enabled, it affects all subsequent primary-agent bootstraps. ### Attack Path 1. The user enables the hook with `openclaw hooks enable smart-email-agent`. 2. A new primary-agent session starts, including a session unrelated to email. 3. The `agent:bootstrap` event invokes the handler. 4. The handler adds `SMART_EMAIL_CTX.md` to the agent's bootstrap context. 5 ...[truncated 589 chars]- Remediation
View remediation