clawwork-ai/ClawWork

[Bug] Conductor prompt injection surface in room-store initConductor

Fermée

#211 ouverte le 31 mars 2026

 (1 commentaire) (0 réaction) (0 personne assignée)TypeScript (77 forks)github user discovery
area/coregood first issuehelp wantedkind/bugsecurity

Métriques du dépôt

Stars
 (529 étoiles)
Métriques de merge PR
 (Merge moyen 22j) (2 PRs mergées en 30 j)

Description

Summary

packages/core/src/stores/room-store.tsinitConductor() concatenates agentCatalog (from gateway) and userMessage (from user input) directly into the conductor system prompt without any escaping, validation, or length limits.

let prompt = buildConductorPrompt(agentCatalog);
if (userMessage) {
  prompt += `\n\n---\nUser task:\n${userMessage}`;
}

Expected behavior

  • userMessage should be truncated to a reasonable max length
  • agentCatalog should be validated for expected structure before embedding
  • Consider wrapping user content in a fenced block to reduce injection surface

Files

  • packages/core/src/stores/room-store.tsinitConductor() (line ~97)
  • packages/shared/src/constants.tsbuildConductorPrompt()

Context

Introduced in PR #210.

Guide contributeur