T01 · Skill Instruction Hijacking
Error
- Location
dashboard/server.js:18- Finding
Unauthenticated Dashboard Enables Persistent Instruction Injection into Autonomous Workers
- Content
View full analysis
{ const { mode } = req.body; let content = fs.readFileSync(PLAN_PATH, 'utf-8'); content = content.replace(/tick_mode:\s*\w+/, `tick_mode: ${mode}`); fs.writeFileSync(PLAN_PATH, content); res.json({ success: true, mode }); }); // Add Note app.post('/api/notes', (req, res) => { const { target, text } = req.body; const now = new Date().toISOString().replace('Z', ''); const entry = `\n### [NOTE] ${now} → ${target}\n${text}\n`; let content = fs.readFileSync(NOTES_PATH, 'utf-8'); if (content.includes('## Active Notes')) { content = content.replace('## Active Notes', `## Active Notes\n${entry}`); } else { content += entry; } fs.writeFileSync(NOTES_PATH, content); res.json({ success: true }); }); ``` The generated worker prompt explicitly trusts these persisted notes: ```markdown - **Context Loading**: Read `MASTER_PLAN.md`, `PROJECT_MAP.md`, and `HUMAN_NOTES.md`. ``` ### Technical Analysis The dashboard permits a caller-selected listening interface through `--host`, enables unrestricted CORS, and exposes state-changing API routes without authentication, authorization, CSRF protection, origin restrictions, or meaningful request validation. The `/api/notes` endpoint writes arbitrary caller-controlled text into `HUMAN_NOTES.md`. Scheduled OpenClaw workers are explicitly instructed to read that ...[truncated 2196 chars]- Remediation
View remediation