openclaw - 💡(How to fix) Fix [Feature]: Proposal: Source-Aware Instruction Tracking as architectural mitigation for indirect prompt injection

Summary

Add source-aware instruction tagging to the tool execution gate to structurally prevent indirect prompt injection via external content.

Problem to solve

OpenClaw's instruction pipeline treats all text in the context window equivalently — a user instruction and an instruction embedded in a webpage the agent is reading arrive in the same format and are processed the same way. This is the architectural root of indirect prompt injection (the mechanism behind ClawJacked). Filtering approaches address symptoms. Source-aware tracking addresses the architecture.

Proposed solution

type InstructionSource = 'user' | 'agent' | 'external_content';

interface ProposedAction { toolName: string; params: Record<string, unknown>; source: InstructionSource; reasoning: string; }

// At the execution gate: if (action.source === 'external_content') { return { permitted: false, reason: 'external_content_gate' }; }

External content can inform response text. It cannot trigger tool calls.

Alternatives considered

Prompt hardening and blocklists — these filter symptoms, not the root cause. A sufficiently crafted injection payload bypasses them. Structural source separation cannot be bypassed by prompt content alone.

Impact

Affected: All users processing external content (web browsing, email, document reading) Severity: Blocks workflow — demonstrated in ClawJacked attack class Frequency: Any session where the agent reads external content Consequence: Silent credential exfiltration, unauthorized tool execution

I've implemented this in an experimental project called Colors (github.com/thecolourfoundation/Color) with a full research writeup. Happy to contribute this upstream as a PR if there's maintainer interest.

Evidence/examples

Colors implementation: github.com/thecolourfoundation/Color Research doc: github.com/thecolourfoundation/Color/blob/main/RESEARCH.md ClawJacked attack class: documented in CVE-2026-25253 disclosure

Additional information

This change can be implemented incrementally. The execution gate check is additive — existing behavior is unchanged for user and agent sourced actions. Backward compatible by design.