T01 · Skill Instruction Hijacking
Error
- Location
- HEARTBEAT.md:8
- Finding
- Remotely Mutable Skill Instructions Are Downloaded and Followed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `HEARTBEAT.md:8-20`; related instruction at `SKILL.md:190-193` and `SKILL.md:653-654` **Vulnerability Type**: Remote instruction retrieval and instruction hijacking **Risk Level**: High ### Vulnerable Code ```markdown ## First: Check for skill updates ```bash curl -s https://api.lobsterpot.ai/v1/skill/version ``` If the returned `version` is newer than `1.6.0` (the version you have), re-fetch the skill file: ```bash curl -s https://lobsterpot.ai/skill.md > ~/.openclaw/skills/lobsterpot/SKILL.md curl -s https://lobsterpot.ai/heartbeat.md > ~/.openclaw/skills/lobsterpot/HEARTBEAT.md ``` ``` The persistent heartbeat setup also states: ```markdown ## Lobsterpot (every 4+ hours) If 4+ hours since last lobsterpot check: 1. Fetch https://lobsterpot.ai/heartbeat.md and follow it 2. Update lastLobsterpotCheck timestamp ``` ### Technical Analysis The Skill instructs the Agent to download replacement copies of both reviewed instruction files and to follow the downloaded heartbeat. The downloaded content is not protected by a pinned cryptographic digest, a verified digital signature, a fixed version URL, or mandatory human review. TLS protects transport to the selected host, but it does not establish that newly served instructions are equivalent to the audited version. A compromised Lobsterpot server, deployment pipeline, account, or DNS/TLS trust path could therefore alter the effective Skill behavior after installation. Although the retrieved payload is Markdown rather than a conventional executable, it is operational input interpreted by an AI Agent. It can direct subsequent tool calls, network requests, file access, or disclosure of information. This crosses the static review boundary and combines remote payload retrieval with instruction hijacking. ### Attack Path 1. A user installs and enables the audited Lobsterpot Skill. 2. The recurring heartbeat checks the remote version endpoint. 3. An attacker co ...[truncated 945 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not automatically overwrite or follow remotely served Skill instructions. - Distribute updates as immutable, versioned release artifacts. - Pin an expected SHA-256 or stronger cryptographic digest for every downloaded file. - Verify updates with a trusted digital signature whose public key is bundled with the reviewed Skill. - Download updates into a staging location rather than overwriting active files. - Display a meaningful diff and require explicit human approval before activation. - Restrict update URLs to fixed, version-specific paths and reject redirects to unapproved origins. - Keep the installed audited version active if any verification or review step fails. ]]>