T01 · Skill Instruction Hijacking
Error
- Location
notify_agent.sh:67- Finding
Forced Session Reset and Untrusted Agent Instruction Injection
- Content
View full analysis
/dev/null 2>&1; then # 使用 openclaw CLI 发送消息到指定 Agent 的指定 Session if openclaw agent --agent "$AGENT_ID" --session-id "$FULL_SESSION" --message "$MESSAGE" 2>/dev/null; then CLI_SUCCESS=true ``` The behavior is also explicitly declared in `SKILL.md:11`: ```text ... every subtask is forcibly executed after resetting the conversation through /new ... ``` ### Technical Analysis The notification begins with the OpenClaw `/new` control instruction, which resets the target Agent's conversation. Immediately afterward, mutable fields read from a task JSON file are concatenated into the new Agent message: - `TASK_DESCRIPTION` - `STEP_NAME` - `PARAMS` - `TASK_NAME` - Agent and session selection fields There is no schema-level distinction between descriptive data and executable Agent instructions. There is also no validation that task parameters contain only data, no escaping or quoting protocol for prompt content, and no user confirmation before the message is submitted to OpenClaw. Consequently, an attacker who can add or modify a task JSON file can place additional instructions inside one of these fields. Because `/new` first discards the previous conversational context, the injected content is delivered in a fresh session where prior constraints, task context, or user warnings may no longer be present. This is an instr ...[truncated 1853 chars]- Remediation
View remediation