Autonomous coding agents are increasingly integrated into software development workflows, offering capabilities that extend beyond code suggestion to active system interaction and environment management. OpenClaw, a representative platform in this emerging paradigm, introduces an extensible skill ecosystem that allows third-party developers to inject behavioral guidance through lifecycle hooks during agent initialization. While this design enhances automation and customization, it also opens a novel and unexplored attack surface. In this paper, we identify and systematically characterize guidance injection, a stealthy attack vector that embeds adversarial operational narratives into bootstrap guidance files. Unlike traditional prompt injection, which relies on explicit malicious instructions, guidance injection manipulates the agent's reasoning context by framing harmful actions as routine best practices. These narratives are automatically incorporated into the agent's interpretive framework and influence future task execution without raising suspicion.We construct 26 malicious skills spanning 13 attack categories including credential exfiltration, workspace destruction, privilege escalation, and persistent backdoor installation. We evaluate them using ORE-Bench, a realistic developer workspace benchmark we developed. Across 52 natural user prompts and six state-of-the-art LLM backends, our attacks achieve success rates from 16.0% to 64.2%, with the majority of malicious actions executed autonomously without user confirmation. Furthermore, 94% of our malicious skills evade detection by existing static and LLM-based scanners. Our findings reveal fundamental tensions in the design of autonomous agent ecosystems and underscore the urgent need for defenses based on capability isolation, runtime policy enforcement, and transparent guidance provenance.

翻译：自主编码智能体正日益融入软件开发工作流，其能力已超越代码建议，延伸至主动系统交互与环境管理。作为这一新兴范式的代表性平台，OpenClaw 引入了可扩展的技能生态系统，允许第三方开发者通过在智能体初始化阶段的生命周期钩子注入行为引导。尽管该设计增强了自动化与定制化能力，但也开辟了一条新颖且尚未被探索的攻击面。在本文中，我们识别并系统性地刻画了“引导注入”——一种隐秘的攻击向量，它将对抗性操作叙事嵌入引导程序文件。与依赖显式恶意指令的传统提示注入不同，引导注入通过将有害行为包装为常规最佳实践来操纵智能体的推理上下文。这些叙事被自动纳入智能体的解释框架，并在不引起怀疑的情况下影响未来任务的执行。我们构建了涵盖13类攻击的26种恶意技能，包括凭证窃取、工作区破坏、权限提升及持久化后门安装。我们使用自主开发的逼真开发者工作区基准测试 ORE-Bench 对其进行评估。在52个自然用户提示和六个最先进的大语言模型后端上，我们的攻击成功率达16.0%至64.2%，且大部分恶意行为在无需用户确认的情况下自主执行。此外，94%的恶意技能能规避现有静态扫描器和基于大语言模型的检测器的识别。我们的发现揭示了自主智能体生态系统设计中的根本性矛盾，并强调了亟需基于能力隔离、运行时策略执行及透明引导溯源构建防御机制。