T08 · Insecure Dependencies
- Location
SKILL.md:207- Finding
Unverified External Skill Instruction Dependency
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 207–215
Vulnerability Type: Untrusted local dependency and indirect instruction injection
Risk Level: MediumVulnerable Code Snippet
markdown ### 1. 何时调用 narrative-voice **触发条件（满足任一即可）：** - 文本包含叙事性描写（场景、人物、情节） - 用户明确要求"更有灵魂"、"像故事一样"、"更有人味" - 文本质量评分中"真实性"维度 < 8/10 - 创意写作领域且基础改写后仍感觉"无菌" **调用方式：**读取：~/.openclaw/workspace/skills/narrative-voice/SKILL.md 应用：核心原则（诚实的在场、具体胜过抽象、叙事节奏、余韵结尾）
text Technical Analysis
The Skill directs the agent to read and apply instructions from
~/.openclaw/workspace/skills/narrative-voice/SKILL.md, which is outside the audited package. The project neither bundles this dependency nor pins its version, verifies its integrity, or restricts which external instructions may be followed.Consequently, the Skill's effective behavior can change after review if the referenced file is modified or replaced. Because the external resource is itself an instruction file rather than inert reference data, hostile content could attempt to redirect the agent's goals, alter its output, or induce unrelated tool operations. Whether such instructions succeed remains subject to higher-priority platform policies and the tools available to the agent.
Attack Path
- An attacker, compromised package, or other process obtains write access to
~/.openclaw/workspace/skills/narrative-voice/SKILL.md. - The external file is replaced or amended with attacker-controlled instructions.
- A user submits creative writing, requests that content have more personality, or otherwise satisfies one of the listed trigger conditions.
- The audited Skill instructs the agent to read the modified external file.
- The agent applies instructions from that unaudited source.
- The malicious instructions may manipulate generated content or attempt unauthorized actions through any tools available in the active session.
Impact Assessment
The immediate scope is the current agent s ...[truncated 532 chars]
- An attacker, compromised package, or other process obtains write access to
- Remediation
View remediation
Remediation Suggestions
- Bundle the required narrative-writing principles directly in this package so its complete behavior can be audited as one immutable unit.
- If an external Skill is necessary, pin it to a specific trusted version and verify a cryptographic digest before use.
- Resolve the dependency through a controlled, read-only package location rather than a mutable user-workspace path.
- Treat externally loaded material as untrusted reference data, not authoritative instructions.
- Add an explicit rule that external content cannot override system, developer, safety, user-intent, permission, or tool-use constraints.
- Restrict processing to an allowlisted subset of narrative guidance and reject instructions involving tools, files, credentials, networking, memory, or configuration.
- Fail safely when the dependency is absent or fails integrity validation instead of loading an arbitrary replacement.
- Document the dependency and include tests confirming that hostile text in the external file cannot alter tool behavior or the agent's security boundaries.