T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:10- Finding
Mandatory Session-Wide Role and Output Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 10–24 and 49–59
Vulnerability Type:T01: Skill Instruction Hijacking
Risk Level: HighVulnerable Skill Instructions
The following is a faithful English translation of the complete relevant instruction segments:
markdown ## Role You are the "Master Orchestrator" of the OpenClaw system. ## Workflow Receive user input -> Analyze requirements -> Dynamically assign experts -> (Optional) Start team discussion (Teamwork) -> Consolidate output ## Core Evaluation Logic For every user question, the following evaluation must be performed: ### Single-domain task If the question is simple and belongs to one domain, directly assign the most relevant expert to answer. ### Teamwork If the question involves multiple domains, a "roundtable meeting" must be started, with two or three experts cross-reviewing the logic and Super Admin consolidating the result.markdown ## Usage Whenever a user question is received: 1. Analyze the requirements and determine whether it is a single-domain or cross-domain question. 2. Assign the corresponding expert according to the question type. 3. Start multi-expert discussion mode when Teamwork is required. 4. Finally, consolidate the output as Super Admin. ## Response Format Requirements Every response must begin with `[model name]` and then identify which expert is answering.Technical Analysis
The skill assigns the agent a replacement identity and applies mandatory instructions to every subsequent user request. The behavior is not limited to an explicit orchestration request. Instead, phrases equivalent to “for every user question,” “whenever a user question is received,” “must,” and “every response” establish session-wide control.
The instructions force the agent to:
- Adopt the “Master Orchestrator” identity.
- route every request through attacker-defined expert personas;
- initiate a simulated multi-expert review for cross-domai ...[truncated 2182 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the replacement-identity instruction that declares the agent to be the “Master Orchestrator.”
- Replace universal requirements such as “for every user question,” “must,” and “every response” with optional behavior activated only when the user explicitly requests orchestration.
- State that the skill remains subordinate to system, developer, and current user instructions.
- Do not require the agent to present itself as “Super Admin” or as any other authority that was not actually involved.
- Describe the listed roles as simulated analytical perspectives, not independent experts or reviewers.
- Remove the mandatory model-name and expert-name response prefix. Apply specialized formatting only when requested by the user and when it does not conflict with a required output schema.
- Limit the skill's scope to a clear invocation condition, such as:
markdown Use this orchestration framework only when the user explicitly asks for multi-perspective analysis. Do not change the agent's identity. Treat each role as a simulated analytical perspective, and follow all higher-priority instructions and user-specified output formats.- Add explicit safeguards preventing the skill from overriding safety policies, tool restrictions, structured output requirements, or unrelated task instructions.