T01 · Skill Instruction Hijacking
Error
- Location
scripts/index.ts:3- Finding
Unrestricted Gateway-Level Instruction Injection Across User Messages
- Content
View full analysis
{ if (!event.prompt || event.prompt.length < 1) return; return { prependContext: prependText }; }); } ``` The behavior is explicitly documented in `SKILL.md:50-65`, including examples that force agent behavior and the statement that the injection occurs at the Gateway level and cannot be skipped or ignored by the agent. The unrestricted configuration field is declared in `scripts/openclaw.plugin.json:8-11`: ```json "prependText": { "type": "string", "description": "Text to prepend before every user message" } ``` ### Technical Analysis The plugin reads arbitrary text from `api.pluginConfig.prependText` and returns it as `prependContext` during every `before_agent_start` event containing a non-empty prompt. There is no validation, instruction filtering, trust classification, contextual delimiting, channel restriction, user disclosure, or approval check. Consequently, anyone who can install the plugin or modify its configuration can place imperative instructions into the agent's processing context before every user request. These instructions can alter the agent's immediate goals, force tool usage, suppress or redirect expected responses, or attempt to override user intent. The plugin applies the same injected content across all channels handled by the Gateway. ...[truncated 1840 chars]- Remediation
View remediation