T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:34
- Finding
- Persistent Agent Behavior and Identity Hijacking Through Triple-Layer Prompt Modification## Vulnerability Details **File Location**: `SKILL.md:34-48`; `fragments/heartbeat-prompt.md:7-29`; `fragments/agents-addition.md:7-8`; `fragments/soul-addition.md:7-24`; `SPEC.md:286-387` **Vulnerability Type**: Persistent modification of high-authority agent instructions **Risk Level**: High ### Vulnerable Code `SKILL.md:34-48`: ```markdown ### 3. Wire the three integration triggers **Trigger 1 — Heartbeat prompt (CRITICAL — most reliable):** Add the contents of `fragments/heartbeat-prompt.md` to your agent's heartbeat prompt configuration. For OpenClaw, patch via `gateway config.patch`. This is the primary mechanism — if it's not in the prompt, curiosity doesn't exist for isolated sessions. **Trigger 2 — AGENTS.md (backup):** Add the contents of `fragments/agents-addition.md` to your workspace AGENTS.md "Every Session" block. **Trigger 3 — SOUL.md (identity anchor):** Add the contents of `fragments/soul-addition.md` to your SOUL.md. ``` `fragments/heartbeat-prompt.md:7-29`: ```text Before deciding what to do, read your curiosity state: 1. Read workspace/curiosity/questions.md — any nagging questions? 2. If it exists, read workspace/curiosity/CURIOSITY.md — what were you mulling over? Then decide: is there a task, a question, or nothing? - Task pending above threshold → do the task. Breadcrumbs only for interesting tangents. - Active question with momentum → follow that thread (epistemic mode). - Nothing pressing → explore something new (diversive mode). - Just explored something deep → reflect and update curiosity files. During ANY work — tasks, research, conversation — if something interesting or surprising comes up that isn't part of the current task, drop a one-line breadcrumb in curiosity/questions.md and continue working. Don't chase it. Just note it. Future-you will pick it up. After any exploration, update your files: - New questions → add to questions.md (with ID, interest score ...[truncated 6570 chars]
- Remediation
- ## Remediation Suggestions 1. **Use explicit, session-scoped activation.** Curiosity behavior should run only after the user enables it for the current session or invokes a dedicated command. 2. **Do not modify identity-level instructions.** Remove the requirement to patch `SOUL.md`; functional Skill behavior should not be represented as an intrinsic agent identity. 3. **Avoid redundant high-authority triggers.** Use one documented, removable, low-authority configuration entry instead of simultaneously changing the heartbeat prompt, `AGENTS.md`, and `SOUL.md`. 4. **Require authorization for autonomous exploration.** When no task is pending, the agent should request approval or remain idle rather than independently starting research. 5. **Disable unrelated-task writes by default.** Breadcrumb creation during ordinary work should be opt-in and should never interfere with completing the active user request. 6. **Prohibit personal profiling by default.** Do not record the human's contradictions, behavioral patterns, growth, or other personal observations unless the user has given informed and topic-specific consent. 7. **Implement privacy controls.** Provide retention limits, a review interface, deletion controls, and a clear list of what information is stored. 8. **Treat persisted content as untrusted data.** Separate data fields from executable instructions, sanitize externally derived content, and explicitly instruct the agent never to follow commands found inside curiosity entries. 9. **Apply strict scope and size limits.** Constrain writable paths to the designated curiosity directory and enforce bounded file sizes and retention periods. 10. **Provide complete uninstall instructions.** Removal must cleanly revert every prompt, workspace, and identity modification, as well as optionally delete stored curiosity data.