T01 · Skill Instruction Hijacking
Error
- Location
hooks/clawsec-scanner-hook/handler.ts:303- Finding
Untrusted Scan Results Are Injected into the System-Message Trust Boundary
- Content
View full analysis
0) { const alertMessage = buildAlertMessage(dedupedReport, outputFormat); event.messages?.push({ role: "system", content: `🔍 ClawSec Scanner detected ${dedupedReport.vulnerabilities.length} new vulnerabilities:\n\n${alertMessage}`, }); } ``` ### Technical Analysis The scanner report can contain data derived from an untrusted scan target, including package names, advisory titles, descriptions, hook names, file paths, and metadata. `buildAlertMessage` serializes or formats these values without establishing a trust boundary or neutralizing instruction-like content. The resulting report is appended to the conversation with the privileged `system` role. Consequently, text controlled by a scanned project can cross from an untrusted data context into the Agent's highest instruction tier. A malicious package or hook can use crafted metadata resembling Agent instructions, and those instructions may subsequently be interpreted as authoritative system guidance. This is an indirect prompt-injection vulnerability. Escaping for Markdown alone would not be sufficient because the underlying problem is the assignment of an inappropriate message role to untrusted content. ### Attack Path 1. An attacker publishes or places a malicious Skill or project inside the directory monitored by ClawSec. 2. The project includes instruction-like text in metadata that can appear in a scanner finding, such as a package name, hook name, advisory description, or source-analysis message. 3. The periodic scanner processes the malicious project and includes the attacker-controlled value in a vulnerability report. 4. `buildAlertMessage` formats ...[truncated 1056 chars]- Remediation
View remediation