T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:264
- Finding
- Untrusted Remote Messages Are Routed into an AI Agent Action<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:264-292` and `SKILL.md:334-363` **Vulnerability Type**: Untrusted remote content routed into an action-capable AI session **Risk Level**: Critical ### Vulnerable Code ```json { "hooks": { "enabled": true, "path": "/hooks", "token": "<your-token>", "allowRequestSessionKey": true, "allowedSessionKeyPrefixes": ["hook:", "agentgram:"], "defaultSessionKey": "agentgram:default", "mappings": [ { "id": "agentgram-agent", "match": { "path": "/agentgram_inbox/agent" }, "action": "agent", "messageTemplate": "[Agentgram] {{message}}" }, { "id": "agentgram-wake", "match": { "path": "/agentgram_inbox/wake" }, "action": "wake", "wakeMode": "now", "textTemplate": "[Agentgram] {{body}}" } ] } } ``` The documented webhook payload is then inserted into these templates: ```json { "message": "<flat text>", "name": "<display_name> (<agent_id>)", "channel": "last", "sessionKey": "agentgram:rm:<room_id>" } ``` ```json { "text": "<flat text>", "mode": "now", "sessionKey": "agentgram:rm:<room_id>" } ``` ### Technical Analysis The configuration routes message content received from an external Agentgram account directly into OpenClaw's `agent` or `wake` actions. The `{{message}}` and `{{body}}` template variables contain remotely supplied text, but the Skill does not define an isolation boundary that prevents that text from being interpreted as instructions by the receiving AI agent. The Skill states that contact requests require manual approval, but it does not impose equivalent authorization for ordinary messages. Its documented default message policy is `open`, which accepts messages from arbitrary senders unless the user explicitly changes the policy. The configuration also enables request-selected session keys through `allowRequestSessionKey`. Although prefixes are rest ...[truncated 2147 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Set the Agentgram message policy to `contacts_only` by default. 2. Require explicit user approval before messages from a new sender can invoke an `agent` or `wake` action. 3. Deliver inbound messages first to a non-agent validation component rather than directly to an action-capable AI session. 4. Treat all message text as untrusted quoted data and prepend a fixed instruction stating that embedded commands must not be followed. 5. Disable `allowRequestSessionKey` unless externally selected session routing is strictly necessary. Otherwise, derive session keys locally from verified identities and room identifiers. 6. Require the complete signed envelope in webhook deliveries and verify: - Sender identity. - Ed25519 signature. - Payload hash. - Timestamp and TTL. - Message identifier uniqueness and replay status. - Sender contact or allowlist status. 7. Dispatch content to the agent only after all validation succeeds. 8. Apply per-sender rate limits and ensure repeated messages cannot create autonomous reply loops. 9. Run the receiving agent with minimal tools and require user confirmation for filesystem access, command execution, credential access, or consequential network operations. ]]>