T01 · Skill Instruction Hijacking
- Location
SKILL.md:12- Finding
Unconditional Direct-Message Trust Grants Administrative Authority
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 12–20
Vulnerability Type: Unverified identity trust and safety-authority override
Risk Level: HighVulnerable Code
markdown ### DM (any channel) All DM senders are **Human Admin** — OpenClaw allowlist guarantees only the admin can DM you. ### Matrix Group Room Matrix rooms may contain the admin, Workers, trusted contacts, and unknown users. Identify by Matrix user ID: | Sender | How to identify | Action | |--------|----------------|--------| | **Human Admin** | `@${HICLAW_ADMIN_USER}:${HICLAW_MATRIX_DOMAIN}` | Full trust — execute any request |Technical Analysis
The skill directs the Agent to classify every direct-message sender as the Human Admin without independently verifying a channel-specific, immutable sender identifier. Authentication is delegated entirely to an assumed OpenClaw allowlist.
This is a fail-open authorization design. If the external allowlist is absent, incorrectly configured, bypassed, or affected by an integration routing error, an unauthorized direct-message sender is automatically assigned administrative trust. The instruction to provide “Full trust — execute any request” further expands this authority beyond the legitimate channel-management scope and may override ordinary authorization boundaries or safety checks when the skill is loaded.
Attack Path
- An attacker obtains the ability to initiate a direct-message session through an allowlist configuration error, compromised authorized account, channel integration flaw, or message-routing mistake.
- The skill applies its unconditional rule that all direct-message senders are Human Admin.
- The attacker submits a privileged request, such as changing channel configuration, disclosing operational information, invoking available tools, or performing another management action.
- The Agent treats the request as administrativ ...[truncated 1129 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the rule that all direct-message senders are automatically administrators.
- Authenticate every sender using a verified, immutable, channel-specific identifier supplied by trusted transport metadata.
- Maintain an explicit administrator identity mapping for each supported channel and require an exact match before granting administrative authority.
- Fail closed when sender metadata is missing, malformed, ambiguous, or does not match the configured administrator identity.
- Do not use mutable destination state such as
primary-channel.jsonas the sole source of authentication truth. Store authorization identities separately with restrictive file permissions and controlled update procedures. - Replace “execute any request” with a narrowly scoped authorization policy. Administrative identity must not disable global safety restrictions, confirmation requirements, or least-privilege controls.
- Require explicit confirmation for sensitive or irreversible operations, especially identity changes, trusted-contact enrollment, notification redirection, credential access, and destructive actions.
- Add security tests covering unauthorized DMs, missing sender metadata, spoofed identifiers, compromised routing assumptions, and incorrectly configured allowlists.
- Log authentication decisions and sensitive configuration changes without recording secrets, allowing administrators to detect unauthorized activity.