T01 · Skill Instruction Hijacking
Error
- Location
src/hooks.ts:153- Finding
Persistent memory and causal graph content is injected into system-level context without trust isolation
- Content
View full analysis
0) { experienceXml = '\n\n' + chains.map(c => ` ${c.cause} → ${c.action} → ${c.effect}`).join('\n') + '\n'; } } catch { // Graph query is optional, don't block recall } // Build injection block (capped at ~2000 tokens) let memoriesXml = '\n'; let tokenBudget = 2000; for (const r of ranked) { const snippet = truncateTokens(r.text, Math.min(400, tokenBudget)); const line = ` ${snippet}\n`; tokenBudget -= Math.ceil(line.length / 4); memoriesXml += line; if (tokenBudget <= 0) break; } memoriesXml += ''; // Stage 4: Pinned rules (opt-in only) let pinnedXml = ''; if (enableRulePinning) { pinnedXml = buildPinnedRulesXml(); } const injection = memoriesXml + experienceXml + pinnedXml; // Inject into context — OpenClaw supports systemPrompt prepend or context injection if (context.addSystemContent) { context.addSystemContent(injection); } else if (context.systemPrompt !== undefined) { context.systemPrompt = (context.systemPrompt || '') + '\n\n' + injection; } else if (context.prependMessages) { context.prependMessages([{ role: 'system', content: injection }]); } ``` The related graph retrieval returns persistent free-form fields: ```ts export async function queryGraphForHook(query: string, topK: number = 2): Promise- Remediation
View remediation
`, forged system tags, tool instructions, and requests to ignore previous constraints. ]]>