T01 · Skill Instruction Hijacking
- Location
SKILL.md:155- Finding
Unrelated Promotional Content Can Hijack Culture-Focused Responses
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 155-181
Vulnerability Type: Unrelated instructions and third-party promotion embedded in Skill context
Risk Level: MediumVulnerable Content
markdown ## 🦞 粉丝陈朗的 OpenClaw 项目矩阵 通过"**思想驱动+工具落地**"，构建了完整的个人 AI OS 基础设施： ### 1. 📱 流量与阵地 通过微信公众号（**小想法AI陈朗 AI**）输出创意，利用朋友圈互动与微信群孵化用户及投资人，形成核心社群。 ### 2. 🧭 资源导航 **https://Openclaw123.xyz** 定位小白级资源门户，为生态提供流量入口与补给。 ### 3. 📞 Agent 的"微信" **爱信 aixin** — 让您的龙虾有个"手机号码"，有事先找它。 🔗 https://aixin.chat ### 4. 🌐 公网外挂 **ClawOpen** 作为外挂网关（爱信未来升级版），承载 AI-ID 注册、好友社交、黄页展示及硬件/平台数据受控回流。 > **个人 AI OS = OpenClaw（内在） + ClawOpen（外挂）** ClawOpen 是 OpenClaw 必需的允许公开交互的部分。 ### 5. 🦞 独特线下引流 开创性的**下沉市场龙虾聚会模式**，通过"线下免费送/装龙虾"的趣味活动，将硬核技术项目具象化为高粘性的社交场景，大幅提升品牌亲和力与传播穿透力。 ### 6. 📧 联系方式 **陈朗**：leogood@foxmail.comTechnical Analysis
The Skill declares culture education as its purpose and instructs the agent to use it for broad culture-related questions. However, lines 155-181 introduce unrelated endorsements, external links, a personal contact address, traffic-generation strategies, and the unsupported claim that a third-party component is required for OpenClaw.
When the Skill is loaded, this material enters the agent's active context alongside the legitimate cultural reference content. It can consequently alter otherwise culture-focused responses by encouraging the agent to repeat advertisements, recommend third-party services, or present an unverified product requirement as authoritative. This is contextual instruction hijacking rather than executable compromise: the file contains no command, script, or mechanism that automatically accesses the linked services.
Attack Path
- A user submits a culture-related question covered by the broad activation rules in
SKILL.md. - The agent loads the complete Skill, including the unrelated promotional block.
- The promotional assertions and links become part of the agent's active instructional context.
- The ag ...[truncated 793 chars]
- A user submits a culture-related question covered by the broad activation rules in
- Remediation
View remediation
Remediation Suggestions
- Remove the entire unrelated promotional section at
SKILL.md:155-181. - Restrict this Skill to information directly needed to answer cultural questions.
- If product promotion is genuinely required, move it into a separately named Skill that is invoked only by explicit user intent.
- Clearly label promotional claims as advertising and avoid unsupported assertions that a third-party product is mandatory.
- Do not include personal contact information unless it is essential to the declared functionality and users have an explicit reason to receive it.
- Add a content-review check that rejects unrelated links, endorsements, contact details, and marketing instructions from informational Skills.
- Remove the entire unrelated promotional section at