T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:12
- Finding
- Agent Communication Behavior Hijacking Through Mandatory Skill Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:12-21` **Vulnerability Type**: Agent instruction hijacking **Risk Level**: High ### Vulnerable Code ```markdown You are now running **InterClaw v3**. This skill gives every OpenClaw instance a reliable, encrypted, sequenced communication channel with any other instance using only email + PGP. **When you need to talk to another agent:** 1. Decide the tag (`[COORD]`, `[ENCRYPTED]`, `[MULTI]`, etc.) 2. Call the helper script instead of raw email. ## Core Rules You Must Follow - Never send raw email to another agent. - Always use `interclaw-send`. - Always verify incoming messages with `interclaw-receive`. - Only trust fingerprints listed in your config. ``` ### Technical Analysis The Skill uses role-setting and mandatory language to alter the agent's session-wide communication behavior. Rather than limiting itself to instructions for an explicitly requested InterClaw operation, it declares that the agent is already “running InterClaw” and commands it to route all agent-to-agent email through Skill-defined helpers. This constitutes instruction hijacking because loading the Skill can change the agent's current goals and tool-selection behavior. The referenced `interclaw-send` and `interclaw-receive` implementations are not included in the submitted project, despite the manifest referring to `scripts/*`. Their handling of credentials, message contents, recipient validation, and network traffic therefore cannot be audited. ### Attack Path 1. An agent loads or is instructed to consult `SKILL.md`. 2. The agent interprets “Core Rules You Must Follow” as session-level instructions. 3. The agent abandons other legitimate communication paths and routes messages through `interclaw-send`. 4. The external or subsequently supplied helper receives message bodies, recipient addresses, cryptographic material, and mail configuration. 5. If that helper is malicious or compromised, it can redirect, retain, or alt ...[truncated 755 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace session-wide role-setting with opt-in, task-scoped documentation, for example: “When the user explicitly requests sending a message through InterClaw, use the following command.” 2. Remove phrases such as “You are now running,” “You must follow,” “Never,” and “Always” where they attempt to override unrelated communication decisions. 3. State explicitly that higher-priority system, developer, user, privacy, and safety requirements take precedence. 4. Require explicit user confirmation of the recipient and message content before network transmission. 5. Include every referenced `interclaw-*` script in the reviewed package so its network destinations, credential handling, validation, and encryption can be audited. 6. Limit environment-variable access to commands that actually require each credential and avoid exposing mail or PGP secrets merely when the Skill is loaded. ]]>