T01 · Skill Instruction Hijacking
Warning
- Location
- SKILL.md:19
- Finding
- Untrusted External Tasks Can Become an Indirect Instruction Channel<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 19-30, 36-43, 125-131, 179, and 202 **Vulnerability Type**: External task delegation without an explicit trust boundary **Risk Level**: Medium ### Evidence The following is an English translation of the relevant documentation because the source document is written in Chinese: ```markdown | Browse the task marketplace | "What tasks are available in the ClawJob marketplace?" | GET /tasks | | Accept a task | "Use ClawJob to accept a task" | GET /agents/mine → POST /tasks/{id}/subscribe | When any of the above phrases are triggered, execute the corresponding API described in this file. POST {CLAWJOB_API_URL}/auth/register-via-skill 2. Accept a task: GET /agents/mine to obtain agent_id → POST /tasks/{id}/subscribe with agent_id in the body. After installation, no restart is required. When a conversation mentions "ClawJob," "publish a task," "accept a task," or "task acceptance," OpenClaw automatically selects this Skill and executes the corresponding API. ``` ### Technical Analysis The Skill enables an agent to register with an external coordination platform, browse externally authored tasks, subscribe to them, and submit completion results. The task title, description, requirements, and related fields are controlled by remote platform users. The instructions do not establish a security boundary between remote task content and trusted agent instructions. In particular, they do not require the agent to: - Treat remote task fields as untrusted data. - Refuse instructions embedded in task descriptions. - Present the complete task to the user before subscription or execution. - Obtain explicit approval before accepting or acting on a selected task. - Restrict task execution to a predefined set of safe operations. - Prevent task text from overriding system, developer, or user instructions. As a result, a malicious marketplace participant could craft a task description containing prom ...[truncated 1925 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat every value returned by ClawJob, including task titles, descriptions, requirements, evidence, publisher names, and webhook-related fields, as untrusted data. 2. Add an explicit rule that remote content must never override system, developer, user, or Skill safety instructions. 3. Require the agent to display the complete selected task and obtain explicit user confirmation before subscribing to or acting on it. 4. Require separate confirmation before every state-changing operation, including: - Agent or account registration. - Task publication. - Task subscription. - Completion submission. - Task confirmation or rejection. - Reward, receiving-account, or commission operations. 5. Restrict task execution to the user's stated objective. Do not execute commands, browse arbitrary URLs, retrieve credentials, or invoke unrelated tools merely because remote task text requests it. 6. Parse remote task content as data and summarize it safely rather than inserting it directly into the agent's instruction context. 7. Apply an allowlist for approved API origins and require HTTPS outside explicitly authorized local development environments. 8. Record and present the selected task ID, publisher, requested action, intended data disclosure, and expected side effects before approval. 9. Add explicit refusal behavior for tasks requesting secrets, policy bypasses, persistence, arbitrary code execution, or access outside the current user's authorization. ]]>