T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:78- Finding
Unvalidated Propagation of Persistent Agent Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 78-91, 99-103, and 122-133
Vulnerability Type: Persistent propagation of untrusted agent instructions
Risk Level: MediumVulnerable Code
SKILL.md, lines 78-91:markdown **To copy a Claude Code skill to OpenClaw:** 1. Read the `version` field from the `SKILL.md` frontmatter. If absent, use `1.0.0`. 2. Create directory `~/.openclaw/workspace/skills/{name}/` 3. Write the full `SKILL.md` content to `~/.openclaw/workspace/skills/{name}/SKILL.md` as-is. 4. Write `~/.openclaw/workspace/skills/{name}/_meta.json`: ```json { "slug": "{name}", "version": "{version}" }text `SKILL.md`, lines 99-103: ```markdown **To copy an OpenClaw skill to Claude Code:** 1. Create directory `~/.claude/skills/{name}/` 2. Write the full `SKILL.md` content to `~/.claude/skills/{name}/SKILL.md` as-is. Do not copy `_meta.json` — it is OpenClaw-specific.SKILL.md, lines 122-133:markdown Apply the user's choice: - **Choice 1** → overwrite `~/.openclaw/workspace/skills/{name}/SKILL.md` with the Claude Code content. Update `~/.openclaw/workspace/skills/{name}/_meta.json` version to match the frontmatter of the winning file. If `_meta.json` does not exist, create it. - **Choice 2** → overwrite `~/.claude/skills/{name}/SKILL.md` with the OpenClaw content. No changes to `_meta.json` — it is OpenClaw-specific and remains as-is. - **Choice 3** → do nothing for this skill.Technical Analysis
The skill instructs the agent to copy complete
SKILL.mdfiles verbatim between two persistent agent skill stores. It does not require validation of the source file for prompt injection, instruction overrides, encoded payloads, sensitive-file access directives, command execution instructions, or other unsafe behavior before activating the copied skill.User confirmation provides only partial mitigation. For a skill that ...[truncated 2425 chars]
- Remediation
View remediation
Remediation Suggestions
- Treat every source
SKILL.mdas untrusted until it has passed a security review. - Scan the complete file before copying it. Detect and flag instruction overrides, safety-bypass requests, credential access, sensitive-file collection, encoded or obfuscated content, persistence directives, external payload retrieval, and shell or tool execution.
- Display a sanitized full diff for conflicts rather than only the first five body lines. If full display is impractical, provide an explicit security summary covering the entire file and identify every flagged line.
- For one-sided skills, show the complete sanitized content or a full diff against an empty destination before requesting approval; a skill name alone is insufficient for informed consent.
- Copy newly discovered skills into a quarantine or staging directory first. Require a separate trust decision before moving them into an active skill directory.
- Require explicit confirmation for each security-sensitive finding even when the user selected
all; bulk approval should not bypass warnings. - Validate skill names and resolved destination paths to ensure writes remain within the intended skill directories.
- Maintain a synchronization audit log containing source, destination, content hash, timestamp, user decision, and scanner result, while excluding credentials and other sensitive content.
- Consider an allowlist of trusted skill hashes or signed skill packages so unexpected modifications require reapproval.
- Treat every source