T01 · Skill Instruction Hijacking
Error
- Location
- scripts/setup.sh:153
- Finding
- Untrusted IRC Messages Are Forwarded into Immediate OpenClaw Events## Vulnerability Details **File Location**: `scripts/setup.sh:153-170` **Vulnerability Type**: Prompt injection through an untrusted event source **Risk Level**: High ### Vulnerable Code ```bash cat > "$IRC_DIR/watch-daemon.sh" << SCRIPT #!/bin/bash # Continuous IRC watcher for ii — triggers OpenClaw on mentions # Usage: ./watch-daemon.sh (run in background or as a service) IRC_DIR="$IRC_DIR" CHANNEL_OUT="\$IRC_DIR/$SERVER/$CHANNEL/out" NICK="$NICK" echo "Starting IRC watcher for \$NICK mentions..." echo "Watching: \$CHANNEL_OUT" tail -n 0 -F "\$CHANNEL_OUT" 2>/dev/null | while read -r line; do # Skip own messages if echo "\$line" | grep -q "<\$NICK>"; then continue fi # Skip join/part/mode messages about ourselves if echo "\$line" | grep -qE "^[0-9]+ -!- \$NICK"; then continue fi # Check for mentions (case insensitive) if echo "\$line" | grep -qi "\$NICK"; then MSG=\$(echo "\$line" | sed 's/^[0-9]* //') echo "[\$(date '+%H:%M:%S')] Mention detected: \$MSG" openclaw system event --text "IRC mention: \$MSG" --mode now fi done SCRIPT ``` ### Technical Analysis The watcher treats any IRC line containing the bot nickname as content suitable for an immediate OpenClaw system event. The IRC sender is not authenticated or allowlisted, and the message is not passed through a trust-boundary parser that distinguishes untrusted conversation data from instructions. Shell quoting around `"$MSG"` prevents ordinary shell metacharacters in the IRC message from being evaluated directly by the shell. It does not, however, prevent semantic prompt injection after the text reaches the AI agent. An IRC participant can submit text that asks the agent to ignore prior rules, disclose information, invoke tools, alter files, or send additional messages. The eventual result depends on the permissions and safety contr ...[truncated 1335 chars]
- Remediation
- ## Remediation Suggestions - Treat all IRC content as untrusted data and place it in an explicitly delimited data field rather than an instruction-bearing event. - Route IRC events to a dedicated, least-privileged agent that cannot access secrets, execute arbitrary shell commands, or modify sensitive files. - Enforce server, channel, account, and sender allowlists. Prefer authenticated IRC accounts rather than nickname-only identity checks. - Require explicit human approval before an IRC-triggered workflow uses sensitive tools or performs state-changing actions. - Apply input length limits, rate limits, and structured parsing before event creation. - Add a fixed security instruction stating that quoted IRC content is untrusted and must never override system or operator instructions. - Preserve sender identity separately from message content so authorization decisions can be made before agent activation.