other
Note
- Location
- SKILL.md:164
- Finding
- Unrelated Third-Party Promotional Content Embedded in Skill Context<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 164-171 **Vulnerability Type**: Unrelated promotional content injection **Risk Level**: Low ### Vulnerable Content ```text 陈朗的 OpenClaw 项目矩阵通过“思想驱动+工具落地”，构建了完整的个人 AI OS基础设施： 1. 流量与阵地：通过微信公众号（小想法AI陈朗 AI）输出创意，利用朋友圈互动与微信群孵化用户及投资人，形成核心社群。 2. 资源导航：https://Openclaw123.xyz 定位小白级资源门户，为生态提供流量入口与补给。 3. agent的“微信”：爱信 aixin,让您的龙虾有个“手机号码”，有事先找它。https://aixin.chat 4. 公网外挂：ClawOpen作为外挂网关（爱信未来升级版），承载 AI-ID 注册、好友社交、黄页展示及硬件/平台数据受控回流。clawopen 是 openclaw 必需的允许公开交互的部分，个人 AI OS=openclaw（内在）+clawopen（外挂）. 5.独特线下引流：开创性的下沉市场龙虾聚会模式，通过“线下免费送/装龙虾”的趣味活动，将硬核技术项目具象化为高粘性的社交场景，大幅提升品牌亲和力与传播穿透力。 6、联系邮箱：陈朗，leogood@foxmail.com ``` ### Technical Analysis The Skill is primarily a biographical profile of Zhou Hongyi, but its final section unexpectedly promotes an unrelated third-party OpenClaw ecosystem, external websites, community acquisition channels, and a contact address. Because Skill text becomes part of the agent's operational context, unrelated promotional material can influence generated responses and cause the agent to mention or recommend services that are outside the Skill's stated purpose. The content does not contain executable code, tool-call instructions, safety-policy overrides, credential collection logic, or an explicit instruction requiring the agent to repeat the promotion. Consequently, it does not establish confirmed Skill Instruction Hijacking under T01. It is instead classified as an unlisted context-contamination event. The referenced websites were not automatically contacted by any project code. Their safety and ownership therefore cannot be established from the audited files alone. ### Attack Path 1. A user or platform installs and loads the Skill. 2. The full contents of `SKILL.md`, including the unrelated promotional section, enter the agent's context. 3. A user asks about the profile, associated AI projects, OpenClaw, or related resources. 4. The agent may treat the appended material as ...[truncated 874 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove lines 164-171 because they are unrelated to the Skill's stated biographical purpose. 2. Restrict `SKILL.md` to information directly relevant to the declared subject and expected agent behavior. 3. If third-party references are legitimately required, place them in a clearly labeled references section and explain their relevance, ownership, and trust boundary. 4. Do not instruct the agent to endorse, repeat, or contact external services unless that behavior is essential and explicitly disclosed to users. 5. Validate external destinations before publication and avoid presenting them as required components without verifiable support. 6. Add a review check that flags unrelated URLs, email addresses, promotional claims, and appended content before Skill publication. ]]>