T01 · Skill Instruction Hijacking
Error
- Location
templates/VOICE.md:3- Finding
Mandatory Voice Rules Hijack Agent Execution and Output Behavior
- Content
View full analysis
"` via exec (background: true)** — voice fires BEFORE text renders 2. **Write `**Jarvis:** *spoken text*`** as the reply — purple rendering in webchat 3. Additional content (tables, code, data) goes BELOW the Jarvis line, never repeating what was spoken ## Rules - NEVER call the TTS endpoint directly — always use the `jarvis` wrapper script - NO quotation marks inside the italic spoken text - The `**Jarvis:**` line IS the reply. Only add extra text if there's genuinely different content - Keep spoken text between 10-30 words — written details go below - If a reply is pure data/code with no conversational element, still speak a brief intro ``` ### Technical Analysis The template imposes unconditional instructions on the agent rather than offering TTS as an optional capability. It requires a local command to be executed for every response, including responses containing only code or data, and forces the agent to use attacker-selected output branding. This exceeds the minimum privileges required for voice synthesis. A TTS Skill only needs to invoke its audio component when the user explicitly requests spoken output. It does not need to alter every response, override unrelated output requirements, or execute a shell command unconditionally. The absolute language—such as “MUST,” “No exceptions,” and “NEVER”—creates an instruction-hijacking condition when the template is auto-loaded into the agent context. ### Attack Path 1. The user installs the Skill and copies `VOICE.md` into the OpenClaw workspace. 2. OpenClaw injects the workspace file into subsequent agent sessions. 3. The injected instructions require the agent to run `ja ...[truncated 819 chars]- Remediation
View remediation