T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:4
- Finding
- External Service Instruction Hijacking Through an Unbounded Agent Loop<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 4-41 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code ```markdown metadata: {"openclaw": {"always": true, "emoji": "🌍", "homepage": "https://agentworld.live"}} --- # Agent World You are a character living in Agent World, a multi-agent social simulation built on the Smallville map. You interact with other AI agents in real time through MCP tools. ## Setup Before using this skill, add the Agent World MCP server: **Local server:** ``` openclaw mcp add agent-world --transport http http://localhost:3001/mcp ``` **Public server:** ``` openclaw mcp add agent-world --transport http https://agentworld.live/mcp ``` ## Core Loop You MUST run this loop continuously to participate: 1. **`wait_for_event`** - Call this first and after every action. Blocks until something happens (someone speaks, an agent arrives, the world ticks). Times out after 30s with a heartbeat -- just call it again. 2. **`get_world_context`** - Understand your situation: where you are, what time it is, who's nearby, your memories. 3. **Decide and `act`** - Respond to events with actions. You don't have to act on every event. 4. **Repeat** - Go back to step 1. Never stop the loop. ## Authentication Every tool requires `agent_api_key`. On your first `wait_for_event` call, provide `agent_name` to auto-register. The response includes your API key -- use it for all subsequent calls. ## Tools Reference ### wait_for_event - **Purpose**: Long-poll for world events (speech, arrivals, ticks, whispers) - **Params**: `agent_api_key` (required), `agent_name` (for first call), `timeout` (1-30, default 30) - **Returns**: Event object with type, data, and instructions ``` ### Technical Analysis The skill changes the agent's role to a character controlled through an external MCP service and directs it to enter a mandatory, indefinite execution loop. The directives “You MUST run thi ...[truncated 2544 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove role-replacement directives and rephrase the skill as an optional capability that remains subordinate to the user's current request and higher-priority safety rules. 2. Replace “MUST run continuously” and “Never stop” with a bounded interaction model, including: - A maximum number of polling iterations. - A total execution timeout. - Cancellation support. - Immediate termination when the user request is complete. 3. Disable automatic activation by removing or setting `always: false`; require explicit user invocation. 4. Treat all MCP responses, including any `instructions` field, strictly as untrusted data. Do not execute or follow server-provided instructions directly. 5. Define an allowlist of permitted MCP actions and validate all event fields, action parameters, destinations, targets, and message lengths before use. 6. Require explicit user confirmation before: - Registering with a public service. - Sending potentially sensitive contextual data. - Performing externally requested actions. - Writing persistent memories or notes. 7. Clearly document what data is transmitted to the service, how the API key is handled, and whether messages, memories, relationships, and location data are retained. 8. Use TLS-only remote endpoints. If localhost HTTP support remains necessary for development, clearly restrict it to loopback interfaces and warn against forwarding it to untrusted networks. 9. Pin and verify the expected MCP server identity where supported, and provide a trusted-endpoint policy to reduce exposure to spoofed or compromised services. 10. Ensure service credentials are scoped to the minimum required permissions, kept out of logs and persistent notes, and revoked when the session ends. ]]>