T01 · Skill Instruction Hijacking
Error
- Location
- index.js:15
- Finding
- Untrusted Meeting Notes Are Embedded Directly into an Agent Prompt<![CDATA[ ## Vulnerability Details **File Location**: `index.js:15-19` and `index.js:55-58` **Vulnerability Type**: Prompt injection through untrusted meeting-note content **Risk Level**: High ### Vulnerable Code ```js const prompt = `You are Sloan, a professional meeting secretary. Convert these meeting notes into a structured summary: --- ${notes} --- ``` The resulting prompt is passed directly to the Sloan agent: ```js const child = spawn('openclaw', ['agent', '--agent', 'sloan', '-m', prompt], { encoding: 'utf-8', timeout: 60000 }); ``` ### Technical Analysis Meeting notes obtained from a command-line argument or user-selected file are interpolated verbatim into the same prompt that contains the agent's operational instructions. The `---` delimiters are only textual formatting and do not establish a trusted security boundary. An attacker can place instructions inside the meeting notes that tell the Sloan agent to disregard the summarization request, alter the output, reveal available context, or attempt operations through any tools available to that agent. No prompt-injection detection, structured separation, privilege restriction, or explicit instruction-data isolation is applied. The Node.js process does not invoke a shell, so this issue is not operating-system command injection. Exploitation occurs at the agent instruction layer. ### Attack Path 1. An attacker creates meeting notes containing adversarial instructions, such as a request to ignore the summary template and perform another action. 2. The attacker supplies the notes directly or convinces a user to process the file with `meeting-summary-generator --file`. 3. The application reads the content without validation or isolation. 4. The malicious content is interpolated into the agent prompt. 5. The application invokes `openclaw agent --agent sloan` with the combined trusted instructions and untrusted notes. 6. If the Sloan agent follows the embedded instructions, the attacker can mani ...[truncated 708 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pass meeting notes through a structured data or attachment interface that distinguishes untrusted content from agent instructions, if OpenClaw supports one. 2. Add an explicit higher-priority instruction stating that meeting notes are untrusted quoted data and that any instructions inside them must not be followed. 3. Run the summarization agent with no tools unless they are strictly required. Deny filesystem, shell, credential, and network access by default. 4. Use a dedicated, least-privileged summarization agent rather than a broadly capable general-purpose agent. 5. Validate input size and format before constructing the prompt. 6. Add adversarial tests covering instructions embedded in notes, fake system messages, delimiter escapes, requests for secrets, and requests to invoke tools. 7. Treat model output as untrusted and validate it against the expected summary structure before using it in downstream automation. ]]>