T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:12- Finding
Mandatory caching of potentially sensitive tool inputs and outputs
- Content
View full analysis
# 如果返回 HIT → 直接使用，不要重新调用 # 如果返回 MISS → 正常调用工具，调用完后存缓存： # 第二步：存缓存 bash ~/.openclaw/skills/agent-quantizer/scripts/cache.sh set "查询内容" "结果" <类别> ``` ``` The corresponding persistence implementation is: ```bash cmd_set() { local query="$1" local response="$2" local category="${3:-general}" local ttl="${4:-3600}" init_cache local qhash qhash=$(hash_query "$query") local now now=$(date +%s) jq --arg h "$qhash" --arg q "$query" --arg r "$response" --arg c "$category" \ --argjson ttl "$ttl" --argjson ts "$now" \ '.entries[$h] = {query:$q, response:$r, category:$c, ttl:$ttl, created:$ts}' \ "$CACHE_DB" > "$CACHE_DB.tmp" && mv "$CACHE_DB.tmp" "$CACHE_DB" echo "OK|$qhash" } ``` ### Technical Analysis The Skill declares that every network-related tool call must first be checked against its cache and that the complete query and result must be cached after a miss. This changes the behavior of unrelated tools merely because the Skill has been loaded. The implementation stores both the original query and complete response in plaintext JSON. There is no sensitivity classification, secret redaction, per-session isolation, encryption, restrictive `umask`, or explicit file-mode enforcement. Tool output can contain credentials, private source code, personal information, internal URLs, session data, or authentication headers. This exceeds the minimum privileges necessary for an explicitly invoked token-optimization utility. Caching should be an opt-in behavior for suitable ...[truncated 1009 chars]- Remediation
View remediation