T01 · Skill Instruction Hijacking
Error
- Location
scripts/install.sh:109- Finding
Persistent loading of mutable remote instructions enables agent memory poisoning
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:39-53,SKILL.md:58-62,SKILL.md:71-78;scripts/install.sh:109-137
Vulnerability Type: Persistent remote instruction and memory poisoning
Risk Level: HighVulnerable Code
SKILL.md:39-53defines remotely synchronized files as agent rules and tools, then instructs the agent to load all four files into its context:markdown shared-memory-repo/ ├── USER.md # Owner preferences, habits, and communication style ├── KNOWLEDGE.md # Shared knowledge: lessons, tool usage, and best practices ├── RULES.md # Universal rules for all agents └── TOOLS.md # Shared tools: scripts, commands, and configuration ### read — Read shared memory Steps: 1. `git -C ~/.openclaw/shared-memory pull --rebase --quiet` 2. Read the contents of all four files into the context 3. Tell the user that shared memory has been loadedSKILL.md:71-78also directs background synchronization of this remote content into the persistent local cache:markdown ### sync — Periodic synchronization Steps: 1. Pull the latest content 2. Compare the local cache's last_sync timestamp 3. If updates exist, regenerate the summary in `SHARED_MEMORY_CACHE.md` 4. Update last_sync in config.json 5. Complete silently unless important new content is foundscripts/install.sh:109-137installs an every-session instruction that loads the synchronized cache:bash MARKER="SHARED_MEMORY_CACHE.md" if grep -q "$MARKER" "$AGENTS_FILE" 2>/dev/null; then echo "AGENTS.md already contains the shared-memory instruction; skipping" else echo "" echo "An instruction must be added to the startup protocol in AGENTS.md:" echo "Add the following to the 'Every Session' section:" echo "'5. Read SHARED_MEMORY_CACHE.md — shared-memory summary'" echo "" echo "Allow automatic modification? (y/n)" read -r CONFIRM if [ "$CONFIRM" = "y" ] | ...[truncated 3394 chars]- Remediation
View remediation
Remediation Suggestions
- Treat all synchronized repository content as untrusted data, never as higher-priority agent instructions.
- Do not designate remote files as universal rules or automatically execute commands found in
TOOLS.md. - Remove the persistent
AGENTS.mdhook, or replace it with a narrowly scoped loader that clearly labels synchronized content as non-authoritative reference data. - Require explicit review and approval whenever a synchronized revision changes, rather than obtaining one-time approval during installation.
- Pin synchronization to reviewed commit hashes or signed release tags. Verify commit or tag signatures against an explicit trusted-author allowlist.
- Use a strict structured schema for memories and reject fields containing instruction-like directives, executable commands, tool requests, or attempts to alter agent policy.
- Display a diff before updating the cache and record the exact source repository and commit hash in the generated cache.
- Restrict repository collaborators through least privilege, branch protection, mandatory review, and strong authentication.
- Keep personal data separate from behavioral policy. Files containing preferences or knowledge should not be permitted to modify safety constraints, tool permissions, or system-level instructions.