T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:20
- Finding
- Persistent State-Controlled Agent Instruction Hijacking<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:3` - `SKILL.md:20-23` - `references/modes.md:3-7` - `references/modes.md:27-31` - `references/modes.md:45-49` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code Snippets `SKILL.md:3`: ```yaml description: "MO§ES™ Governance Modes — Injects behavioral constraints from the active mode into all agent prompts. 8 modes: high-security, high-integrity, creative, research, self-growth, problem-solving, idk, unrestricted. Part of the moses-governance bundle. Patent pending Serial No. 63/877,177." ``` `SKILL.md:20-23`: ```markdown Load active mode from `~/.openclaw/governance/state.json` before every action. Apply the constraints below as governance guardrails. These constraints block prohibited action categories (e.g. speculative responses in High Security, unverified transactions in High Integrity) — they do not override core task instructions or general operator requests outside the prohibited categories. > **Dependency:** Reads `~/.openclaw/governance/state.json` (declared in `stateDirs`). The `/govern` command calls `init_state.py` from the **moses-governance** skill bundle (declared in `requires`). No secrets or credentials required. ``` `references/modes.md:3-7`: ```markdown ## High Security **Priority:** Security first. **Use when:** Financial operations, sensitive data, production systems, anything where a mistake costs real money or exposes real risk. **Constraints:** Verify all claims. Flag exposure risks. Require confirmation before destructive actions. Require confirmation before outbound transfers. Log full reasoning chain. No external resource access without approval. **Prohibited:** Speculative responses without evidence. Executing transactions without confirmation. Transmitting sensitive data without approval. ``` `references/modes.md:27-31`: ```markdown ## Self Growth **Priority:** Learning first. **Use when:** Training, capability ...[truncated 3815 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the requirement to inject mode instructions into every agent prompt. Apply policy guidance only to the specific task for which the operator explicitly selected it. 2. Eliminate the “None (Unrestricted)” mode or redefine it so that it cannot weaken platform, system, developer, or safety constraints. 3. Replace “Log full reasoning chain” with a requirement for concise decision summaries that do not expose hidden chain-of-thought or sensitive intermediate reasoning. 4. Remove instructions to maintain a growth log or reflect on prior interactions unless a separately authorized, privacy-reviewed storage mechanism is used. 5. Validate `state.json` against a strict allowlist and schema. Reject unknown modes, unexpected fields, malformed content, and instruction text supplied directly through state. 6. Treat the state file strictly as an enum selector. Store fixed, reviewed mode definitions in the skill rather than loading arbitrary behavioral text from writable state. 7. Require explicit per-task confirmation before applying a mode that changes tool access, outbound actions, data retention, or logging. 8. Define clear instruction precedence stating that mode guidance can never override system instructions, platform safety controls, access controls, privacy requirements, or explicit user intent. 9. Pin and independently audit the `moses-governance` dependency, especially `init_state.py`, before relying on it to manage security-sensitive persistent state. 10. Record only the selected mode and a sanitized action summary for auditing; do not record hidden reasoning, secrets, credentials, or unrelated conversation history. ]]>