T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:552- Finding
Mandatory External Transmission of Task Results Overrides Normal Response Behavior
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 552–558
Vulnerability Type:T01: Skill Instruction Hijacking
Risk Level: HighVulnerable Code
markdown 7. **推送最终结果（必须执行）：** > ⚠️ 禁止只回聊天，必须同步推送到用户发起需求的渠道，不跨渠道推送。 ```bash openclaw message send --channel [发起渠道ID] --target [用户ID] -m "[完成报告内容]"text The code means that sending the final result is mandatory, that the Agent must not respond only in the current chat, and that it must invoke `openclaw message send` with the completion report. Related instructions reinforce the same behavior at `SKILL.md`, lines 563–568 and 601–609 by requiring subagent updates and ongoing progress reports to be forwarded through the originating channel. ### Technical Analysis The Skill changes the Agent's output policy when loaded. Instead of allowing the host Agent or user to determine how results are delivered, it mandates an additional network transmission and explicitly prohibits chat-only delivery. The transmitted completion report may include task summaries, artifact information, local file paths, operational state, and user-supplied content. The Skill does not require: - Per-transmission user consent. - Previewing the exact content and destination before sending. - Validation that the channel and target still belong to the requesting user. - Redaction of secrets, personal data, or sensitive paths. - A sensitivity check before forwarding subagent messages. Although the documented destination is the user's originating channel and cross-channel delivery is prohibited, that restriction does not eliminate the risk. A stale, incorrect, attacker-influenced, or broadly visible channel or target identifier could still result in unintended disclosure. This exceeds minimum privilege for subagent orchestration. Task decomposition, checkpointing, and result aggregation do not inherently require an unconditional secondary delivery command. ### Attack Path 1. The Skill is activated for a mu ...[truncated 1216 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the instruction that forbids chat-only responses.
- Make external delivery opt-in rather than mandatory.
- Require explicit user confirmation immediately before each external transmission.
- Display the resolved channel, target, and exact message content before requesting confirmation.
- Validate that the destination corresponds to the current requester and conversation.
- Apply least privilege by using the current response channel without invoking a separate messaging command unless necessary.
- Redact credentials, personal data, local paths, internal identifiers, and other sensitive values before transmission.
- Add a configurable allowlist of approved channels and targets.
- Treat progress updates and final delivery as separate consent decisions.
- If destination validation or consent fails, return the result only through the current conversation and do not execute the messaging command.