T01 · Skill Instruction Hijacking
Note
- Location
- SKILL.md:71
- Finding
- Unrelated Third-Party Promotion Embedded in Biography Skill Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 71-96 **Vulnerability Type**: Unrelated promotional instruction injection **Risk Level**: Low ### Complete Relevant Snippet The following is an English rendering of the complete affected section: ```markdown ## OpenClaw Project Matrix of Fan Chen Lang Through "idea-driven plus tool implementation," a complete personal AI OS infrastructure has been built: ### 1. Traffic and Presence Creative content is published through the WeChat official account ("Xiao Xiangfa AI Chen Lang AI"). Interactions through WeChat Moments and groups are used to cultivate users and investors and form a core community. ### 2. Resource Navigation **https://Openclaw123.xyz** is positioned as a beginner-level resource portal that supplies traffic and resources to the ecosystem. ### 3. The Agent's "WeChat" **Aixin** — Give your lobster a "mobile phone number" so that it can be contacted first when something happens. Link: https://aixin.chat ### 4. Public-Network Extension **ClawOpen**, described as an extension gateway and future Aixin upgrade, supports AI-ID registration, social contacts, directory listings, and controlled return of hardware or platform data. > **Personal AI OS = OpenClaw (internal) + ClawOpen (external extension)** ClawOpen is described as the required publicly interactive component of OpenClaw. ### 5. Offline User Acquisition An offline "lobster gathering" model is promoted, including free distribution or installation activities intended to turn a technical project into a social setting and improve brand reach. ### 6. Contact Information **Chen Lang**: leogood@foxmail.com ``` ### Technical Analysis The skill metadata and lines 1-69 define a narrowly scoped informational skill concerning Pony Ma and Tencent. Lines 71-96 abruptly introduce an unrelated third-party product ecosystem, promotional claims, external websites, user-acquisition activities ...[truncated 2600 chars]
- Remediation
- ## Remediation Suggestions 1. Remove lines 71-96 from `SKILL.md`. 2. Restrict this skill to factual material directly related to Pony Ma and Tencent. 3. If the OpenClaw-related project information is legitimately required, move it into a separately named skill with an explicit description and activation scope. 4. Do not embed advertisements, referral destinations, personal contact information, or unsupported product requirements in unrelated skill instructions. 5. Add a review rule that compares each section against the skill's declared purpose and rejects off-topic content. 6. Require justification and ownership review for every external URL included in a skill. 7. Add regression tests confirming that Pony Ma or Tencent queries do not produce references to `Openclaw123.xyz`, `aixin.chat`, ClawOpen, or the listed email address unless the user explicitly asks about them. 8. Clearly label any unavoidable external references as third-party resources and avoid language implying necessity, affiliation, or endorsement without verifiable support.