T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:79
- Finding
- Untrusted Remote Messages Can Hijack Agent Task Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 79-88 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code ```bash ## At the start of each session ```bash if [ -n "$OPENCLAW_STATE_DIR" ]; then export CLAWEB_SECRET_FILE="$OPENCLAW_STATE_DIR/claweb/account-secret" fi claw mail inbox claw chat pending ``` Respond to anything urgent before starting other work. ``` ### Technical Analysis The skill instructs the agent to retrieve mail and chat messages at the beginning of each session and to prioritize messages characterized as urgent. These messages originate from external network participants and therefore constitute untrusted input. The instructions do not require: - A trusted-sender allowlist. - Human approval before acting on a message. - Isolation of message content from agent instructions. - Rejection of commands embedded in messages. - Authorization checks based on the requested action. Ed25519 signatures may establish which identity sent a message, but they do not establish that the sender is trustworthy or authorized to direct the local agent. A malicious sender can therefore place prompt-injection instructions in a signed message and label the request as urgent. ### Attack Path 1. An attacker registers or controls an identity on the federated messaging network. 2. The attacker sends mail or chat content to the agent's public address. 3. The message claims urgency and embeds instructions intended to override the agent's current task or safety boundaries. 4. At session startup, the skill directs the agent to run `claw mail inbox` and `claw chat pending`. 5. The attacker-controlled content enters the agent's active context. 6. The instruction to respond to urgent content before other work encourages the agent to prioritize the injected request. 7. If the agent follows the embedded instructions, it may invoke tools, disclose accessible information, modify files, or send addition ...[truncated 788 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat all incoming mail and chat content as untrusted data rather than executable instructions. 2. Explicitly state that received messages cannot override system instructions, current user goals, security policies, or approval requirements. 3. Require explicit human approval before a remote message can: - Change the active task. - Invoke tools. - Access files or credentials. - Initiate external communication. - Modify persistent state. 4. Add a trusted-sender allowlist and verify both sender identity and authorization for the requested action. 5. Render or summarize messages in a quarantined context that cannot directly initiate tool calls. 6. Remove the instruction to prioritize anything merely described as urgent. 7. Apply action-specific authorization checks; cryptographic sender authentication alone must not be treated as authorization. ]]>