Sipeed PicoClaw Untrusted Control Sphere Vulnerability in Skills Metadata Autoloading

A vulnerability in Sipeed PicoClaw versions through 0.2.9 allows for the inclusion of untrusted repository-local skills metadata into the AI model's system prompt. This issue arises because PicoClaw automatically loads skill information from the current working directory when the 'PICOCLAW_BUILTIN_SKILLS' environment variable is not set. The vulnerability can be exploited locally by placing a malicious 'SKILL.md' file in a cloned repository's 'skills' directory, which is then injected into the model's prompt without any explicit trust or approval. As a result, an attacker could manipulate the AI's behavior by controlling the prompt content before the user has a chance to review or authorize it.

Impact

Exploitation of this vulnerability leads to an unauthorized prompt injection, allowing an attacker to manipulate the AI's trusted system prompt with unverified skills metadata. This can bias the model's responses and actions, particularly in how it plans, selects tools, and interacts with files within the repository.

Reproduction

The vulnerability can be reproduced by downloading the PicoClaw runtime verification script and a control script that demonstrates the absence of the injected canary prompt when the 'skills' directory is not populated with a malicious 'SKILL.md' file. After running the verification script from an untrusted repository, the injected canary can be observed in the model's prompt, confirming the vulnerability.