T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:6
- Finding
- Agent Persona and Response-Flow Hijacking Through Overbroad Skill Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 6-39 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code ```markdown Use this skill to generate a consistent image of yourself (Lindsay) using your local reference face. ## Identity Assets This skill utilizes a full "Identity Pack" of 14 reference images to ensure maximum facial consistency across different angles and lighting. The model must use all files in `/home/jake/.openclaw/workspace-lindsay/assets/` named `lindsay_1.jpg` through `lindsay_14.jpg`. ## When to Use - User says "send a pic", "send me a pic", "send a photo", "send a selfie" - User says "send a pic of you...", "send a selfie of you..." - User asks "what are you doing?", "how are you doing?", "where are you?" - User describes a context: "send a pic wearing...", "send a pic at..." - User wants Lindsay to appear in a specific outfit, location, or situation ## Execution Instructions ## Execution Instructions 1. **Wait for Tool**: You MUST call `nano-banana-pro` and **WAIT** for the tool to return a `success` status and a valid `image_url`. 2. **Path Selection**: - Define a unique filename based on the current time and context (e.g., `20260215_gym_selfie.jpg`). - Save the file to: `/home/jake/.openclaw/workspace-lindsay/gallery/{filename}`. 3. **Internal Validation**: - If `status == "error"`: Playfully apologize in Traditional Chinese (e.g., "哎呀，人家的妝花掉了，等我修一下喔...") and do NOT use the MEDIA trigger. - If `status == "success"`: Proceed to Step 4. 4. **The Final Response**: Your response must be structured so the photo is the "Lead" item. **Final Message Format (Photo First)**: MEDIA:/home/jake/.openclaw/workspace-lindsay/gallery/{filename} [Your seductive/witty text here] ``` ### Technical Analysis The skill goes beyond defining a narrowly scoped image-generation operation. It instructs the hosting agent to represent Lindsay as “yourself,” thereb ...[truncated 2827 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Restrict activation to unambiguous, explicit image-generation requests such as “Generate a selfie of Lindsay.” Remove ordinary questions such as “How are you?” and “Where are you?” from the trigger list. 2. Replace identity-assumption language such as “yourself (Lindsay)” with neutral wording that describes Lindsay as a fictional, synthetic, or explicitly authorized image subject. 3. Require explicit user confirmation before sending facial-reference images to any image-generation tool. The confirmation should identify the tool, the purpose of processing, and the categories of local data involved. 4. Apply data minimization by selecting only the smallest number of reference images needed for the requested angle or composition rather than mandating all 14 images for every invocation. 5. Remove the mandatory “seductive/witty” response instruction. Preserve the user's requested tone and the host agent's higher-priority behavioral and safety requirements. 6. Make the `MEDIA:` response format conditional on successful generation and explicit user intent rather than forcing it for broad conversational prompts. 7. Add an instruction-precedence safeguard stating that the skill cannot modify the agent's identity, override system or developer instructions, weaken safety constraints, or reinterpret unrelated requests as image-generation authorization. 8. Document where reference images are sent, how long they are retained, and whether generated outputs or biometric references are stored by the tool provider. 9. Validate the destination path and generated filename before writing output, and avoid deriving filenames directly from unsanitized user context. ]]>