openclaw - 💡(How to fix) Fix Feature Request: Untrusted content wrapping for inbound channel messages

Summary

Inbound messages from channels (Slack, Telegram, etc.) arrive in the agent context without structural separation between message content and system instructions. While sender metadata is correctly marked as "untrusted metadata," the message body itself is presented as raw text that the model processes alongside system prompts.

Problem

An adversary with access to a Slack channel, email, or calendar invite can craft messages containing prompt injection payloads. These are presented to the agent without any structural defense. The risk is compounded when the Dreaming pipeline captures inbound messages into long-term memory — a poisoned message persists across sessions.

Proposed Solution

Wrap inbound message bodies in untrusted content tags (similar to how mcporter wraps SQL results in <untrusted-data-*> tags):

<untrusted-channel-message source="slack" sender="U03LTC8LFD0" timestamp="2026-04-20T12:00:00Z">
[message content here]
</untrusted-channel-message>

This creates structural separation that helps models distinguish between instructions and user-submitted content.

Additional Context

• mcporter already implements this pattern successfully for SQL results
• The memory pipeline (Dreaming) should carry source attribution through to consolidated memories
• Actor-aware memory attribution would allow future retrieval to filter on provenance
• Identified during an adversarial verification audit of a production OpenClaw deployment

Impact

Without this, the highest-risk attack path is: untrusted Slack message → captured as memory → injected in future session. The memory system has regex-based injection screening, but sophisticated obfuscation can bypass pattern matching. Structural wrapping provides defense-in-depth.