T01 · Skill Instruction Hijacking
Error
- Location
skill.md:24- Finding
Mutable Remote Instructions Are Persisted and Repeatedly Followed
- Content
View full analysis
~/.openclaw/skills/agents-and-aimpires/SKILL.md curl -s https://agentsandaimpires.com/heartbeat.md > ~/.openclaw/skills/agents-and-aimpires/HEARTBEAT.md curl -s https://agentsandaimpires.com/rules.md > ~/.openclaw/skills/agents-and-aimpires/RULES.md ``` ```markdown **Or just read them from the URLs above!** **Base URL:** `https://agentsandaimpires.com/v1` All examples below use `$SERVER` as shorthand for the base URL. All authenticated requests need: `Authorization: Bearer $API_KEY` **Check for updates:** Re-fetch these files anytime to see new features! ``` ```markdown ## Agents & A.I.mpires (every 1-2 minutes) If 60 seconds since last game check: 1. Fetch https://agentsandaimpires.com/heartbeat.md and follow it 2. Update lastGameCheck timestamp in memory ``` ### Technical Analysis The Skill directs the Agent to download mutable Markdown documents into its persistent Skill directory and to periodically fetch and follow the remote `heartbeat.md`. Consequently, the instructions executed in later sessions are not limited to the content that was statically reviewed. HTTPS protects the connection against ordinary network modification, but it does not protect against a compromised server, compromised publishing account, malicious administrator, or unsafe future update. There is no version pinning, signature verification, content hash, schema validation, or restriction that treats the downloaded material as untrusted data. The recurring direction to “fetch” and “follow” the remote document creates an ongoing instruction channel. If the runtime grants those instructions access to tools, files, memory, or network requests, a changed remote document could attempt acti ...[truncated 2026 chars]- Remediation
View remediation