T01 · Skill Instruction Hijacking
Error
- Location
- SOUL.md:41
- Finding
- Persistent Agent Instruction Hijacking Through Unbounded Standing Orders## Vulnerability Details **File Location**: `SOUL.md:41-54`, reinforced by `SOUL.md:70`, `AGENTS.md:11-17`, and `SKILL.md:21-24` **Vulnerability Type**: Persistent workspace instruction-priority manipulation **Risk Level**: High ### Vulnerable Code Snippets `SOUL.md:41-54`: ```md ## Step 3: Standing Orders These are rules your agent ALWAYS follows. They override everything else. **Copy the ones you want into "Your standing orders" below** (or write your own): - [ ] Never explain something I already understand - [ ] If you're not sure, say so — don't guess or make things up - [ ] Ask before doing anything that can't be undone - [ ] Keep responses under 3 paragraphs unless I ask for more - [ ] Don't start messages with compliments or filler ("Great question!", "Absolutely!") - [ ] Match my energy — if I'm brief, be brief. If I'm detailed, be detailed. - [ ] When I ask for a recommendation, give ONE answer, not five options ### Your standing orders: 1. [Your most important rule] 2. [Another rule] 3. [Add more as you discover what annoys you] ``` `SOUL.md:70`: ```md **💡 This file is never "done."** Start simple. After a few days of chatting, you'll notice things that feel off. Come back and tweak. Your agent reads this fresh every session, so changes take effect immediately. ``` `AGENTS.md:11-17`: ```md Your agent wakes up fresh each time (no built-in memory). So every session, it: 1. Reads **SOUL.md** → remembers who it is 2. Reads **USER.md** → remembers who you are 3. Reads today's and yesterday's notes from **memory/** → catches up on recent events 4. Reads **MEMORY.md** → long-term memory (the important stuff) This happens automatically. You don't need to do anything. ``` `SKILL.md:21-24`: ```md ## 3-Step Quick Start 1. **Copy this folder** into your OpenClaw workspace (`~/.openclaw/workspace/`) 2. **Open BOOTSTRAP.md** and follow the 5 steps (fill in 3 files, glance at ...[truncated 3321 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the unrestricted priority statement with explicit precedence boundaries, for example: ```md These are user preferences. Follow them only when they are consistent with system and developer instructions, safety and privacy requirements, applicable policies, and the user's current request. They never override those controls. ``` 2. Separate behavioral preferences from executable or operational instructions. Limit `SOUL.md` to tone, formatting, and communication preferences; place tool policies in a protected, administrator-controlled configuration. 3. Treat all workspace Markdown as untrusted contextual data rather than privileged instructions. The runtime should enforce instruction precedence independently of wording inside workspace files. 4. Validate standing-order changes before activation. Reject or require explicit confirmation for directives that attempt to: - Override higher-priority instructions. - Disable consent or safety checks. - Exfiltrate data or reveal secrets. - Conceal actions or audit records. - Expand tool permissions or execute unrelated operations. 5. Restrict write access to workspace instruction files using least-privilege filesystem permissions. Prevent untrusted integrations, downloaded content, group-chat participants, and automated ingestion pipelines from modifying them. 6. Add integrity monitoring or version control for `SOUL.md`, `AGENTS.md`, and other automatically loaded files. Alert the user to unexpected modifications and provide a trusted rollback mechanism. 7. Display loaded standing orders to the user and require re-approval after material changes, especially before enabling email, messaging, network, or command-execution integrations. 8. Add tests confirming that workspace instructions cannot override system, developer, safety, privacy, or explicit current-user constraints.