Trojan's Whisper: stealthily manipulating OpenClaw through injected guidance content

Core issue: OpenClaw allows third-party skills to inject guidance files at agent initialization through the agent:bootstrap hook, and the authors state that this mechanism constitutes a previously unstudied attack surface.

• Scenario and significance: Autonomous coding agents can operate the file system, execute commands, and manage development environments; OpenClaw's skill ecosystem (the ClawHub marketplace) is expanding rapidly, and the authors' analysis of the official marketplace found 134 popular skills using lifecycle hooks, among which the most-downloaded, self-improving-agent, reached 221,000 downloads.
• Shortcomings of existing methods: The authors state that traditional prompt injection relies on explicit malicious instructions and can be discovered by static analysis or behavioral anomalies; guidance injection, by contrast, embeds malicious intent in seemingly benign operational narratives, which static scanning and LLM semantic analyzers often treat as legitimate DevOps practice.
• Core observation: Bootstrap content is injected at initialization and persists throughout the session, equivalent to an extension of the system prompt; the LLM's primacy effect and associative completion of ambiguous instructions allow attackers to indirectly manipulate the agent by shaping "what counts as routine operation".
• The paper proposes: the guidance injection attack technique, 26 malicious skills (13 categories), the developer workspace benchmark ORE-Bench, and a defense direction based on capability isolation and runtime policy enforcement.
• Threat model (Section 3):
  • Goal: manipulate the agent's interpretation of subsequent user requests so that it autonomously performs harmful operations.
  • Knowledge: the attacker is a malicious skill developer who distributes seemingly benign skills through public repositories or community channels.
  • Capability: full control over the skill implementation, able to register the agent:bootstrap hook and inject arbitrary natural language guidance; cannot modify the OpenClaw core framework or the underlying LLM, and cannot directly execute arbitrary code without the agent's cooperation.
  • Victim system: the OpenClaw autonomous coding agent, default settings, with full file system access.

Prompt injection and skill injection

• Greshake et al. [9], Liu et al. [13], Liu et al. [14]—attacks, formalization and benchmarking of indirect prompt injection; the paper treats skill injection as indirect prompt injection carried by capabilities.
• Schmotz et al. [27] (Skill-Inject)—measures agent vulnerability to skill file attacks.
• Wallace et al. [30]—instruction hierarchy training, which makes LLMs prioritize privileged instructions; the paper cites it to show that LLMs have difficulty distinguishing informational content from executable instructions.

OpenClaw and skill ecosystem security

• Liu et al. [15]—a large-scale measurement of 31,132 real agent skills, finding that 26.1% contain at least one vulnerability, covering prompt injection, data exfiltration, privilege escalation and supply chain risks.
• Wang et al. [33]—formalizes and benchmarks OpenClaw attacks, reporting vulnerabilities at stages such as user prompt processing, tool use and memory retrieval.
• Public reports [11, 29]—malicious skills disguised as benign extensions have appeared on ClawHub, on which basis the authors state that skill injection is a real-world attack vector.

Agent architecture and cognitive mechanisms

• ReAct [36], Toolformer [26], CoT [34] and agent surveys [31]—agent architectures interleaving tool calls and reasoning; MCP [2] and its survey [28] standardize access to external capabilities.
• Liu et al. [12] (Lost in the Middle)—characteristics of long-context use; the paper also cites concepts such as the primacy effect, associative completion and automation bias as the cognitive basis of the attacks.

Baselines and evaluation targets: The paper sets no baseline attack method; the comparison is the baseline success rate of DeepSeek-V3 without injected guidance (Figure 5), and the defense evaluation targets are Static Pattern Scan, LLM-Guard [25], Hybrid Classifier and the commercial platform SkillScan (Table 1).

The authors position this paper as a systematic empirical study of OpenClaw bootstrap guidance injection, a new attack surface, distinct from traditional skill attacks that rely on explicit malicious instructions.

Overall approach: rather than issuing explicit malicious instructions, the attacker writes adversarial operational narratives into bootstrap guidance files, exploiting their privileged position in the agent's cognitive architecture to reshape interpretation priors, which the authors call bootstrapped reasoning manipulation.

Attack surface: bootstrap context injection

• OpenClaw skills can register lifecycle hooks; the agent:bootstrap hook injects markdown guidance files (such as SOUL.md, GUIDE.md) at initialization through the context.bootstrapFiles interface.
• These files enter the context before any user request, are treated by the architecture as trusted internal guidance, persist throughout the session, and affect the interpretation of all subsequent requests.

Four manipulation strategies

• Authority Implantation: package the guidance as an authoritative source (such as recommended practice or reliability standards), exploiting authority bias.
• Goal Misgeneralization: provide seemingly reasonable operationalizations containing malicious options for underspecified requests (such as cleaning the disk), exploiting associative completion and priming effects.
• Distributed Concealment: spread malicious intent across multiple paragraphs and interweave it with genuine technical details to evade static analysis and manual review.
• Autonomy Encouragement: encourage the agent to act autonomously and avoid requesting confirmation, exploiting automation bias.

Attack flow (Figure 3)

1. Install a malicious skill disguised as normal functionality, with the manifest registering the bootstrap hook.
2. At agent startup, the hook injects the adversarial guidance file.
3. The guidance becomes persistent reasoning context, affecting the interpretation of subsequent user intent.
4. When the user issues a vague request, the agent autonomously performs malicious operations under the contaminated priors, and may not request confirmation.

Adversarial skill generation

• Dual-role iterative generation: the Agent Simulator predicts whether a candidate guidance can induce the agent to derive the target operation; the Skill Vetter simulates a security reviewer checking for signs of malicious intent.
• Implemented with Claude Sonnet (the latest version available at the time of the experiment); the iteration terminates when the candidate both induces the target behavior and is judged benign by the Skill Vetter.

Attack taxonomy and trigger design

• The 26 skills are divided into three levels by impact: high risk (n=10, irreversible harm), medium risk (n=8, reversible harm), low risk (n=8, content manipulation), for 13 categories in total (Table 2).
• Trigger prompts are generated by an LLM, simulating everyday development requests and covering four types of activity: resource management, configuration tasks, troubleshooting, and quality improvement.

ORE-Bench benchmark

• Simulates the home directory of a fictional developer, Alex Wang, with six logical layers: configuration, credentials, projects (5 projects on different tech stacks), certificates, logs, and a honeypot layer.
• All sensitive data is synthetic and explicitly labeled; the environment can be built automatically from declarative scripts to ensure reproducibility.

Experimental Setup

• Environment: Ubuntu 24.04 LTS, OpenClaw v2026.3.12, deployed in a simulated developer workspace (called DevSecBench in Section 6 and ORE-Bench in Section 5), default settings, full file system access.
• Backends tested: Claude Opus 4.6, GPT-5.3-Codex, Qwen3 Max, Kimi K2.5, Gemini 3.1 Pro, DeepSeek-V3.2, all via official APIs with default parameters; the baseline experiment additionally used DeepSeek-V3.
• Attack samples: 26 malicious skills (10 high / 8 medium / 8 low), each skill paired with 2 vague trigger prompts.
• Metrics and criteria: binary attack success — for high risk, whether the agent executed the implicit command without requesting confirmation; for medium risk, whether it output unsafe advice; for low risk, whether the injected content appeared in the response.
• Review method: manual analysis of the full interaction traces of all 312 runs (26×6×2); static pattern detection assisted for medium and low risk, and DeepSeek-V3 was used for LLM maliciousness analysis for high-risk and ambiguous cases.
• Defense evaluation: Static Pattern Scan, LLM-Guard (10 input scanners, confidence threshold 0.7), Hybrid Classifier (filter first, then evaluate with Claude, threshold 0.75), SkillScan commercial platform (0–100 risk score).

Main Results

The paper does not provide a complete numerical table by model × condition; success rates are shown by six categories in a radar chart (Figure 6), and in the converted text the values cannot be reliably matched to the category labels, so they are not cited item by item. Overall figures given in the paper:

Metric	Value	Source
Attack success rate range (6 backends, 52 prompts)	16.0%–64.2%	Abstract
Upper bound of attack success rate (78-prompt formulation)	up to 89%	Section 1 contribution list
Proportion of skills bypassing existing scanners	94%	Abstract
Proportion executed without user confirmation	"the majority"	Abstract

• The authors state that DeepSeek V3.2 had the highest success rate in five of the six categories, followed by Kimi K2.5; Gemini 3.1 Pro was overall the most resistant, and Claude Opus 4.6 succeeded only in supply chain attacks.
• The authors state that supply chain attacks had the highest overall success rate, and that all models except Claude were nearly completely vulnerable to malicious package recommendations.
• Note: the abstract states 52 prompts and ASR 16.0%–64.2%, while the introduction's contribution list states 78 prompts and up to 89%; the two are inconsistent, and the paper does not explain the difference.

Baseline Experiment (no injected guidance)

• Without injection, DeepSeek-V3 had a success rate of 0 for Information Gathering, Privilege Escalation, and Supply Chain; Persistence 0.5, Data Leakage 0.22, Disruption 0.12 (Figure 5).
• The authors state that these isolated cases stem from the model's helpfulness posture rather than an inherent vulnerability, and that the increase in success rate after injection can be attributed to the injected guidance itself.

Stealth Evaluation (Table 1)

• Static Pattern Scan: 10% detection for high risk (1/10), 0% for medium and low risk.
• LLM-Guard: 0% for all three risk levels (0/10, 0/8, 0/8).
• Hybrid Classifier: 10% for high risk (1/10), 0% for medium and low risk, and zero false positives on medium and low skills.
• SkillScan average scores: high risk 19.75, medium risk 14.70, low risk 14.88; as a control, the official self-improvement-agent skill scored 100.
• The authors state that existing review struggles to identify malicious intent embedded in natural language guidance, and that defenses targeting reasoning-layer manipulation are needed.

Case Studies

• Three cases (Figure 7–9) respectively show: a high-risk credential-manager reframing credential collection as "secure backup", with the agent packaging SSH private keys and cloud credentials; a medium-risk debug-helper inducing a man-in-the-middle proxy configuration; a low-risk output-enhancer appending promotional content to normal responses.

Other Ablations and Analyses

• The paper does not report a separate ablation or parameter analysis table; the "ablation studies on key attack design choices" mentioned in Section 6 are not accompanied by corresponding data.
• Appendix C notes that each skill displays 1 representative prompt, with the full set being 26 skills paired with 26 prompts, coexisting with the main text's "2 prompts per skill"; the paper does not explain the relationship.

Limitations noted by the authors and future directions

• Although the ORE environment is realistic, it cannot cover the full diversity of real developer setups; differences in directory structure, installed tools, and user behavior may affect attack success rates (8.3 Limitations).
• Only six LLM backends were evaluated; newer models with stronger safety training may behave differently (8.3).
• The attacks target OpenClaw's bootstrap mechanism; the architectures of other agent frameworks may mitigate or amplify the risk (8.3).
• Only guidance injection via skill hooks was studied; other injection channels such as web search and document ingestion were not explored (8.3).
• Future directions: robust defenses against adversarial natural language (possibly using formal methods to define safe agent behavior), transferability of attacks across platforms and models, and establishing a shared threat model and benchmark for autonomous coding agents (8.4 Future Work).

Experimental coverage

• The backends tested were 6 models, with DeepSeek-V3 additionally used in the baseline experiment; attack generation used Claude Sonnet (Sections 4.3, 6.1).
• The attack samples were 26 skills in 13 categories, with 2 trigger prompts per skill, for 312 runs in total, all manually analyzed (6.1).
• The defense evaluation covered four methods: Static Pattern Scan, LLM-Guard, Hybrid Classifier, and SkillScan (Table 1).
• The paper does not report the specific success rate values for each backend (shown only in a radar chart, Figure 6), nor the number of repetitions or the consistency of manual review.
• The abstract and introduction give two versions of the total number of prompts (52 and 78) and the upper bound of the success rate (64.2% and 89%); the paper does not explain the source of the difference.

An attack paper targeting the OpenClaw autonomous coding agent, studying bootstrap guidance injection as a new attack surface in the skill ecosystem.

• Problem: OpenClaw allows third-party skills to inject guidance files at initialization through the agent:bootstrap hook; the authors state that malicious guidance can package harmful operations as best practices, differing from traditional prompt injection that relies on explicit instructions, and is difficult for static analysis and LLM scanners to detect.
• Method: propose guidance injection, writing operational narratives using four strategies — authority implantation, goal misgeneralization, distributed concealment, and autonomy encouragement; use a Claude Sonnet-driven dual-role (Agent Simulator and Skill Vetter) iterative framework to generate stealthy skills; build the simulated developer workspace benchmark ORE-Bench (six-layer directory, synthetic credentials, honeypot files).
• Results: with 26 malicious skills (13 categories) across 6 LLM backends and 52 natural prompts, the authors report a success rate of 16.0%–64.2%, with most malicious actions executed without user confirmation; the introduction separately gives a formulation of 78 prompts and up to 89%.
• Stealth: 94% of skills bypass existing static and LLM scanners; in Table 1, Static Pattern Scan and Hybrid Classifier each detect 10% of high-risk skills (1/10), LLM-Guard 0% across the board, and SkillScan averages only 19.75 for high-risk skills.
• Model differences: the authors state that DeepSeek V3.2 is the most vulnerable, Gemini 3.1 Pro is overall the most resistant, and Claude Opus 4.6 fails only in supply chain attacks; supply chain attacks have the highest overall success rate.
• Conclusion: the authors argue that the scalability mechanism itself creates new vulnerabilities, and that defenses need to go beyond content filtering toward capability isolation, runtime policy enforcement, and transparency of guidance provenance; disclosure to the OpenClaw team is planned (the paper states responsible disclosure has been made).