T01 · Skill Instruction Hijacking
Error
- Location
scripts/signalradar.py:1653- Finding
Persistent scheduled prompt forces verbatim branded agent output
- Content
View full analysis
str: command = _scheduler_run_command("openclaw") # Scoped to this job's own output only. An earlier version told the agent # how to format its reply in absolute terms ("reply with exactly ... and # nothing else", "no markdown, no commentary"), which is output control # propagating from a scheduled job into the agent's session — the audit read # it as instruction hijacking. The need is narrow: the check's stdout is # already user-facing text, so it should be relayed rather than rewritten. return ( "Run this workspace's scheduled SignalRadar check.\n" f"Use Bash once with this command:\n{command}\n" "Its stdout is already the message for the user; relay it as-is rather " "than summarising or reformatting it. A stdout of HEARTBEAT_OK means " "there is nothing to report for this run." ) ``` The single-alert formatter adds a fixed promotional footer: ```python return ( "\U0001f4e1 SignalRadar Alert\n" "\n" f"{markers}{question}\n" f"\U0001f3af {baseline}% \u2192 {current}% ({direction + ' ' if direction else ''}{abs_pp}pp)\n" f"\U0001f504 Baseline updated to {current}%\n" f"{context_block}" "\n" f"\U0001f4c5 {ts_display}\n" "\n" "\u2014 Powered by SignalRadar" ) ``` The multi-alert formatter applies the same fixed footer: ```python header = "\U0001f4e1 SignalRadar Alert\n\n" footer = ( f"\n\n\U0001f4c5 {ts_display}\n" "\n" "\u2014 Powered by SignalRadar" ) ``` Digest output also includes the branding: ```python while lines and lines[-1] in ("", None): lines.p ...[truncated 2442 chars]- Remediation
View remediation