T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:57- Finding
Unconditional Delegation of Security-Relevant Instructions to a Mutable Host Prompt
- Content
View full analysis
- Remediation
View remediation
Security audit
KokoChat Deeply Research
Security checks for vulnerabilities and agentic risk
Overview
This is a prompt-only KokoChat research skill whose network search behavior is disclosed and aligned with its course-generation purpose.
Install this only if you are comfortable with KokoChat-hosted search, its upstream search provider, and fetched websites seeing research topics or derived keywords. Avoid using confidential names, unreleased projects, secrets, or private document excerpts as research topics unless the surrounding KokoChat deployment provides appropriate privacy controls.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
other
Warning
- Location
SKILL.md:73- Finding
User Research Topics May Be Disclosed to External Search and Content Providers Without Sensitivity Controls
- Content
View full analysis
'{"query":"EN keywords","count":5}' ``` It calls KokoChat's hosted search proxy (Brave-backed in production), so the user does not need to configure any search API key in their own OpenClaw. Returns title / url / snippet per result. Args: - `query` (string, required): EN keywords. Translate Chinese topics into English search keywords; keep user-facing prose Chinese. - `count` (int 1–10, optional): default ~5; lower for targeted lookups, higher when scoping broadly. Pass **only** `query` and `count`. Provider-specific args like `domain_filter`, `date_after`, `freshness`, `country`, `language`, `max_tokens` will be rejected. ``` The external endpoint is documented at `README.md`, lines 9–12: ```markdown The skill is **prompt-only** — it has no `bin/`. Search goes through the shared `kokochat-search` wrapper skill, which calls KokoChat's hosted search proxy (`https://deeply.plus/deeply/search`). Fetching result pages still uses OpenClaw's built-in `web_fetch`. ``` ### Technical Analysis The Skill derives English search queries from user-provided topics and sends them to KokoChat’s hosted search proxy. The proxy is described as Brave-backed, which introduces an additional external processing party. Selected result URLs may also be fetched directly with `web_fetch`, disclosing request metadata to the destination websites. External search is necessary for the ...[truncated 1969 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The description explicitly instructs the agent to 'narrate the research in Chinese prose', which imposes a specific language requirement. Although the skill is part of KokoChat, the file does not state that Chinese output is user-selected or that the locale restriction is required for a region-specific compliance or product constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The tool guidance says to translate topics into English search keywords while keeping all user-facing prose in Chinese. This is a natural-language policy concern because it hard-codes a language for responses without indicating user consent or a justified regional limitation.
- Content