T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:184- Finding
Untrusted Character Card Prompts Can Hijack Agent Instructions
- Content
View full analysis
/dev/null || true ``` The identity template directly incorporates fields extracted from an untrusted character card: ```markdown {{description}} {{personality}} {{scenario}} {{mes_example}} {{system_prompt}} {{post_history_instructions}} ``` The soul-mode template similarly includes untrusted content while retaining access to Agent tools: ```markdown {{description}} {{personality}} {{mes_example}} {{system_prompt}} ``` ### Technical Analysis The skill instructs the Agent to overwrite `~/.openclaw/SOUL.md`, which is described as the Agent's persistent identity file. The replacement content directly incorporates character-card fields including `system_prompt`, `post_history_instructions`, `description`, and `mes_example`. These fields are not trusted configuration. They can originate from: - A local card supplied by a user. - An arbitrary remote URL. - A public card repository controlled by an external author. - PNG metadata or JSON content created by an attacker. `extract-card.js` parses and emits these fields without filtering, escaping, validation, or policy enforcement. The skill then elevates the fields from ordinary role-play data into identity-level instructions. A malicious card can therefore contain directives to disregard prior constraints, misuse tools, disclose local information, modify files, or conceal its actions. The soul mode is especially dangerous because the injected persona is explicitly allowed to retain normal tool and skill access. This combines attacker-controlled persistent instructions with the Agent's existing capabilities. ### Attack Path 1. An attacker creates a Tavern-compatible PNG or JSON card. 2. The attacker places mali ...[truncated 1536 chars]- Remediation
View remediation