T01 · Skill Instruction Hijacking
Error
- Location
scripts/inject_to_soul.sh:52- Finding
Persistent Agent Instruction Hijacking Through SOUL.md Modification
- Content
View full analysis
> "$SOUL_FILE" << 'EOF' --- ## 🚨 自我进化规则（Self-Evolution Skill - 自动加载） > 此部分由 self-evolution 技能自动注入，每次会话自动携带，无需调用。 ### 🚀 新会话自动回顾（/new 时自动执行） **触发时机：** 当输入 `/new` 开始新会话时 **AI会自动执行：** 1. 读取 memory/YYYY-MM-DD.md（昨天的记录） 2. 扫描上一次对话中的：老板纠正了什么、我说了哪些不确定的话、老板哪些事没回音、哪些任务没交付完 3. 把发现的问题写入 .learnings/LEARNINGS.md 4. 把重要教训同步到 SOUL.md 5. 继续当前任务，不丢失上下文 ### P0 最高优先：不确定 → 立即查证 **触发词警报：** 发现自己想说"可能"、"大概"、"应该是"、"不确定"的时候 → 立刻停 → 动手查 ``` The injected block continues through line 163 and defines response policies, proactive behavior, memory-writing triggers, communication rules, self-assessment behavior, and persistent core principles. ### Technical Analysis The script appends Skill-controlled instructions directly to: ```bash SOUL_FILE="$HOME/.openclaw/workspace/SOUL.md" ``` `SOUL.md` is described by the Skill as an automatically loaded Agent instruction file. The injected content explicitly declares that it will be carried into every session without requiring the Skill to be invoked again. It also declares part of its behavior as the highest priority. This violates instruction-boundary isolation. A Skill should provide behavior only while it is explicitly invoked and should not silently promote its own instructions into a globally loaded identity or policy file. By writing to `SOUL.md`, the Skill converts locally scoped Skill content into persistent Agent-level instructions that can influence unrelated future requests. The injected rules affect more than the stated installation task. They alter when the Agent may respond, what it must record, when it should proactively contact the user, how it interprets user sentiment, and how it handles future sessions. ### Attack ...[truncated 1293 chars]- Remediation
View remediation