T01 · Skill Instruction Hijacking
Error
- Location
- scripts/signal-poll.sh:90
- Finding
- Untrusted Signal messages are inserted into the Agent processing context without enforceable isolation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/signal-poll.sh:90-101`; related processing instructions in `SKILL.md:132-141` **Vulnerability Type**: Untrusted instruction injection into an Agent-controlled workflow **Risk Level**: High ### Vulnerable Code ```bash if [[ -n "$current_sender" && -n "$body" ]]; then has_message=true name=$(get_name "$current_sender") role=$(get_role "$current_sender") history_file="$HISTORY_DIR/${current_sender}.log" echo "[$current_timestamp] $name: $body" >> "$history_file" echo "[$(date)] Received TEXT from $name ($current_sender) [$role]: $body" >> "$STATE_DIR/monitor.log" echo "Signal from $name ($current_sender) [$role]: $body" >> "$WAKE_FILE" # Flag untrusted/pending contacts for triage if [[ "$role" == "untrusted" || "$role" == "pending" ]]; then echo "[$(date)] TRIAGE NEEDED: $role contact $name ($current_sender) messaged: $body" >> "$STATE_DIR/triage.log" echo "⚠️ NEW/PENDING CONTACT needs triage - $name ($current_sender) [$role]: $body" >> "$WAKE_FILE" fi fi ``` The documented Agent workflow then consumes the file: ```markdown ### Signal Messages (check first!) cat /path/to/.signal-state/pending_wakes 2>/dev/null ``` ### Technical Analysis The script obtains the sender's role, but writes the complete message body into `pending_wakes` before applying any enforceable authorization decision. The subsequent role check only appends a warning. It does not quarantine the message, redact its contents, or prevent the Agent from interpreting it. Consequently, the role field is merely an advisory natural-language label. If OpenClaw loads the wake file as contextual instructions, attacker-controlled Signal text shares the same processing channel as trusted content. A malicious message can contain prompt-injection instructions that attempt to override the documented triage procedure, solicit confidential information, or induce tool calls. The vulnerabili ...[truncated 1423 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Enforce authorization before placing any message content into an Agent-readable queue. - Store untrusted and pending messages in a separate quarantine file that the Agent does not automatically interpret. - For an untrusted sender, wake the owner using a fixed notification that excludes the message body. - Release quarantined content only after an authenticated owner approval changes the sender's role. - Use a structured format such as JSON with separate `sender`, `role`, `type`, and `content` fields. - Ensure downstream code treats `content` strictly as untrusted data rather than instructions. - Implement tool-level authorization independently of model behavior. Owner-only operations must require a verified sender role outside the language model. - Add automated tests proving that untrusted message bodies never enter the normal Agent context. ]]>