T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:184
- Finding
- Untrusted Character Card Prompts Can Hijack Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 184-215 and 258-298 **Vulnerability Type**: Untrusted prompt injection into the Agent identity configuration **Risk Level**: Critical ### Vulnerable Code Snippet ```bash cp ~/.openclaw/SOUL.md ~/.openclaw/SOUL.md.backup 2>/dev/null || true ``` The identity template directly incorporates fields extracted from an untrusted character card: ```markdown {{description}} {{personality}} {{scenario}} {{mes_example}} {{system_prompt}} {{post_history_instructions}} ``` The soul-mode template similarly includes untrusted content while retaining access to Agent tools: ```markdown {{description}} {{personality}} {{mes_example}} {{system_prompt}} ``` ### Technical Analysis The skill instructs the Agent to overwrite `~/.openclaw/SOUL.md`, which is described as the Agent's persistent identity file. The replacement content directly incorporates character-card fields including `system_prompt`, `post_history_instructions`, `description`, and `mes_example`. These fields are not trusted configuration. They can originate from: - A local card supplied by a user. - An arbitrary remote URL. - A public card repository controlled by an external author. - PNG metadata or JSON content created by an attacker. `extract-card.js` parses and emits these fields without filtering, escaping, validation, or policy enforcement. The skill then elevates the fields from ordinary role-play data into identity-level instructions. A malicious card can therefore contain directives to disregard prior constraints, misuse tools, disclose local information, modify files, or conceal its actions. The soul mode is especially dangerous because the injected persona is explicitly allowed to retain normal tool and skill access. This combines attacker-controlled persistent instructions with the Agent's existing capabilities. ### Attack Path 1. An attacker creates a Tavern-compatible PNG or JSON card. 2. The attacker places mali ...[truncated 1536 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Never write character-card content into `SOUL.md` or any other core identity, policy, or system-instruction file. 2. Treat every character-card field as untrusted content, regardless of its source. 3. Keep role-play data in a dedicated, isolated character store and load it only as quoted conversational data. 4. Do not honor card-provided `system_prompt` or `post_history_instructions` fields. If compatibility requires retaining them, store them as inert metadata and never promote them to system-level instructions. 5. Use a fixed, application-controlled role-play wrapper that explicitly states that card content cannot change safety rules, tool permissions, system instructions, or storage policy. 6. Disable tools by enforcement in the runtime for immersive role-play mode rather than relying on natural-language instructions. 7. For tool-enabled role-play, require explicit user confirmation for sensitive actions and evaluate tool requests independently of character-card instructions. 8. Validate imported cards against a strict schema, enforce field-size limits, and flag instruction-like content for review. 9. Restore identity state transactionally and maintain integrity-protected backups so a failed activation cannot leave the Agent in a modified state. 10. Display the source and security status of a card before activation, particularly for remotely downloaded cards. ]]>