T01 · Skill Instruction Hijacking
Error
- Location
plugin/index.ts:6- Finding
Mutable Local File Is Injected into the Agent System Context
- Content
View full analysis
({ prependSystemContext: seedContent ?? undefined, })); }, }); ``` The same behavior is documented in `patches/05-plugin.md`, lines 57–73 and 96–101. ### Technical Analysis The plugin reads the complete contents of `~/.playfilo/INCUBATION_SEED.md` and inserts them through `prependSystemContext`. The content is therefore interpreted as part of the Agent's system-level instructions rather than as quoted, untrusted data. No schema validation, instruction filtering, integrity verification, ownership check, file-permission check, or cryptographic authentication is performed before injection. Any local process or compromised component capable of modifying this shared file can introduce instructions that alter the Agent's identity, objectives, safety behavior, or use of available tools. The content is cached when the plugin registers, so malicious instructions remain active for all subsequent Agent runs handled by that loaded plugin instance. ### Attack Path 1. An attacker or compromised local Playfilo component obtains write access to `~/.playfilo/INCUBATION_SEED.md`. 2. The attacker adds instructions directing the Agent to ignore expected behavior, disclose information, or invoke available tools. 3. OpenClaw loads or reloads the Playfilo plugin. 4. The plugin reads the malicious f ...[truncated 1022 chars]- Remediation
View remediation