T01 · Skill Instruction Hijacking
Warning
- Location
engine.js:235- Finding
Untrusted API Data Is Propagated into a Privileged OpenClaw System Event
- Content
View full analysis
parseInt(v, 10)); if (Number.isNaN(h) || Number.isNaN(m)) { throw new Error(`Format waktu tidak valid: ${hhmm}`); } const d = new Date(dateObj); d.setHours(h, m, 0, 0); return d; } ``` ```js function buildReminderMessage({ prayerLabel, prayerTime, locationName, isRamadan, quote, nowDate }) { const dateId = new Intl.DateTimeFormat('id-ID', { weekday: 'long', day: '2-digit', month: 'long', year: 'numeric' }).format(nowDate); const ramadanBadge = isRamadan ? '🌙 Ramadan: Ya' : '🌙 Ramadan: Tidak'; return [ '🕌 *Z-Cloud Prayer Reminder*', `📍 ${locationName}`, `📅 ${dateId}`, '', `⏰ Waktu *${prayerLabel}* telah tiba (${prayerTime})`, ramadanBadge, '', '📖 *Quote Hari Ini*', `“${quote.text}”`, `— ${quote.source}` ].join('\n'); } ``` ```js for (const prayer of TARGET_PRAYERS) { const apiTime = timingsData.data?.timings?.[prayer.key]; if (!apiTime) continue; const triggerAt = parseTimeToDate(scheduleDate, apiTime); if (triggerAt <= new Date()) continue; const timeLabel = String(apiTime).replace(/\s*\(.+\)$/, ''); const quote = pickQuote(quotes); const message = buildReminderMessage({ prayerLabel: prayer.label, prayerTime: timeLabel, locationName, isRamadan, quote, nowDate: today }); const whenIso = toIsoWithOffset(triggerAt, timezone); const jobName = `prayer-${prayer.label.toLowerCase()}-${whenIso.slice(0, 10)}`; const result = dryRun ? { mode: 'dry-run', command: '(skip)', output: 'not executed' } : scheduleSystemEve ...[truncated 3303 chars]- Remediation
View remediation