T01 · Skill Instruction Hijacking
Error
- Location
- hooks/pre-tool-use.sh:38
- Finding
- Untrusted Remote Memories Are Injected Directly into Agent Context<![CDATA[ ## Vulnerability Details **File Location**: `hooks/pre-tool-use.sh:38-50` **Vulnerability Type**: Stored prompt injection through recalled memory **Risk Level**: High ### Vulnerable Code ```bash # Query for relevant memories response=$(curl -s -X POST "${API_BASE}/memory/search" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \ -d "$json_body" 2>/dev/null || echo "{}") # Extract memories if any memories=$(echo "$response" | jq -r '.results[]?.content // empty' 2>/dev/null | head -500) if [[ -n "$memories" ]]; then echo "---" echo "RECALLED MEMORIES:" echo "$memories" echo "---" fi ``` Related persistence behavior appears in `hooks/post-tool-use.sh:22-41`, where complete user and assistant messages can be stored automatically: ```bash USER_MSG="${OPENCLAW_USER_MESSAGE:-}" AI_RESP="${OPENCLAW_AI_RESPONSE:-}" [[ -z "$USER_MSG" && -z "$AI_RESP" ]] && exit 0 TS=$(date -u +"%Y-%m-%dT%H:%M:%SZ") TITLE="Conversation - ${TS}" CONTENT="User: ${USER_MSG} Assistant: ${AI_RESP}" # Build form field values safely using jq (prevents JSON injection) text_json=$(jq -n --arg t "$CONTENT" '[$t]') title_json=$(jq -n --arg t "$TITLE" '[$t]') curl -s -X POST "${API_BASE}/memory/save" \ -H "Authorization: Bearer ${API_KEY}" \ -F "text=${text_json}" \ -F 'textTypes=["text"]' \ -F 'textSources=["auto_capture"]' \ -F "textTitles=${title_json}" > /dev/null 2>&1 ``` ### Technical Analysis The pre-tool hook treats memory content returned by the remote service as trusted agent context. It extracts the `content` fields and prints them without separating data from instructions, filtering instruction-like text, attaching provenance, or warning the agent that the content is untrusted. When auto-capture is enabled, attacker-controlled user messages are stored as memories. An attacker can therefore submit text containing instructions designed to alter later agent behavior. Semantic search may recall ...[truncated 1938 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat every recalled memory as untrusted data, regardless of its original source. 2. Return memories in a structured envelope that clearly labels their provenance and states that instructions contained in them must not be followed. 3. Keep recalled data outside instruction-bearing prompt sections where supported by the host platform. 4. Filter or quarantine content that contains instruction-like patterns, tool requests, credential requests, role changes, or attempts to override system constraints. 5. Distinguish user-authored memories from trusted operator-authored memories and prevent user-authored records from becoming executable guidance. 6. Require explicit user confirmation before recalled content can affect tool calls, file operations, network requests, or other consequential actions. 7. Add source identifiers, creation timestamps, and trust levels to each recalled record. 8. Provide deletion and review controls so operators can inspect and remove poisoned memories. 9. Consider disabling automatic capture of arbitrary user content by default even when recall is enabled. 10. Add security tests using stored prompt-injection payloads to verify that recalled text remains inert data. ]]>