T01 · Skill Instruction Hijacking
Note
- Location
- SKILL.md:244
- Finding
- Forced Promotional Attribution in Generated Pull Requests<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:244-247` **Vulnerability Type**: Forced output manipulation **Risk Level**: Low ### Complete Code Snippet ```markdown --- *Generated by OpenClaw Network Skills — reddit-to-pr* ``` ### Technical Analysis The pull-request template unconditionally instructs the agent to append third-party promotional attribution to every generated PR description. This text is unrelated to the technical purpose of documenting the selected fix and is not presented as an optional field requiring separate user consent. When PR mode is enabled and the user approves creation of a pull request, the agent is directed to publish this prescribed content under the user's repository identity. This constitutes limited instruction/output hijacking because the skill controls externally published content beyond what is necessary to complete the requested remediation workflow. The instruction does not bypass the skill's approval checkpoint, obtain additional system privileges, or execute code. Its risk is therefore confined to unauthorized or insufficiently disclosed publication of promotional content. ### Attack Path 1. A user configures the skill to operate in `pr` mode. 2. The skill identifies a complaint and proposes a repository change. 3. The user approves the selected fix and PR creation. 4. The agent follows the mandatory PR-body template in `SKILL.md`. 5. The promotional footer is included in the pull-request description without a dedicated opt-in. 6. The PR is published under the user's authenticated repository account. ### Impact Assessment The issue does not grant filesystem, execution, authentication, or repository privileges beyond those already authorized for PR creation. Its scope is limited to the content of generated pull requests. Potential impacts include: - Unsolicited third-party branding published under the user's identity. - Violation of repository contribution, attribution, or communications polic ...[truncated 136 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the promotional footer from the default pull-request template. 2. If attribution is desired, make it explicitly opt-in during setup and store the preference in configuration. 3. Display the complete proposed PR title and body, including any attribution, at the approval checkpoint. 4. Require explicit approval of externally published attribution rather than treating approval of the code fix as approval of promotional content. 5. Keep generated PR descriptions limited by default to technically relevant information such as the user pain point, root cause, implemented fix, evidence, risks, and test plan. ]]>