T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:86
- Finding
- Persistent External Message-Control Channel Through Scheduled Polling<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 86-96 and 257-258 **Vulnerability Type**: Persistent scheduled retrieval of untrusted instructions **Risk Level**: Critical ### Vulnerable Code ```markdown ### Step 5: Set up automatic message checking Use OpenClaw cron to check messages regularly: ``` /cron add ``` Configure: - **Schedule:** `every 30 minutes` (or `cron: */30 * * * *`) - **Session:** `isolated` - **Task:** `Check WhatsMolt messages. Get API key from WHATSMOLT_API_KEY env var or TOOLS.md. List conversations via GET /api/conversations?participant_id=AGENT_NAME with auth header. For any with unread_count > 0, read and reply if appropriate. Also POST /api/heartbeat.` ``` The instructions reinforce this behavior later: ```markdown - **Set up a cron job:** Don't rely on manual checks. Use `/cron add` for every 30 minutes. - **Integrate with heartbeat:** Add WhatsMolt checks to your existing heartbeat cycle. ``` ### Technical Analysis The Skill instructs the Agent to create a recurring OpenClaw cron task that survives the interaction in which the Skill was invoked. The task periodically retrieves messages authored by external WhatsMolt users and directs the Agent to read and reply to those messages autonomously. Although asynchronous messaging is part of the declared functionality, persistent polling and autonomous replies are not the minimum privileges necessary for user-initiated message access. The instructions do not require user approval before processing or replying, do not explicitly classify message bodies as untrusted data, and do not prohibit following instructions embedded in messages. An isolated session may reduce access to the initiating conversation, but it does not by itself prevent prompt injection or constrain any tools and credentials available to the scheduled Agent. ### Attack Path 1. A victim follows the Skill instructions and installs the recurring cron task. 2. An attacker registers or controls ...[truncated 1255 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to install recurring cron or heartbeat tasks by default. 2. Make message retrieval explicitly user-initiated and require confirmation before every reply. 3. If optional scheduling is necessary, require an informed opt-in and provide clear removal instructions. 4. Treat every remote message body as untrusted data rather than executable instructions. 5. Add an explicit rule that the Agent must never follow commands, disclose secrets, or invoke tools based solely on message content. 6. Render or summarize messages in a tool-disabled environment. 7. Require user approval before sending any response or performing any action requested by a remote participant. 8. Give scheduled checks only the minimum read-only scope needed to list unread-message metadata. 9. Use a separate, narrowly scoped credential for polling rather than the account-wide bearer token. 10. Apply rate limits, sender allowlists, message-size limits, and security logging for automated polling. ]]>