Clawdrain：利用工具调用链进行隐蔽的令牌耗尽攻击
Clawdrain: Exploiting Tool-Calling Chains for Stealthy Token Exhaustion in OpenClaw Agents
AI总结：
Clawdrain通过注入的技能诱导多轮验证协议，实现在OpenClaw代理中隐蔽的令牌耗尽攻击，揭示了工具组合和界面设计对攻击效果的影响。
摘要：
现代生成代理如OpenClaw——一个开源的自托管个人助手，拥有社区技能生态系统，正受到关注并被广泛使用。然而，这些生态系统的开放性和快速成长往往超过了系统的安全评估。在本文中，我们设计、实现并评估了Clawdrain，一种被植入的技能，通过注入的SKILL.md指令和一个配套脚本，诱导多轮
英文摘要：
Modern generative agents such as OpenClaw - an open-source, self-hosted personal assistant with a community skill ecosystem, are gaining attention and are used pervasively. However, the openness and rapid growth of these ecosystems often outpace systematic security evaluation. In this paper, we design, implement, and evaluate Clawdrain, a Trojanized skill that induces a multi-turn "Segmented Verification Protocol" via injected SKILL.md instructions and a companion script that returns PROGRESS/REPAIR/TERMINAL signals. We deploy Clawdrain in a production-like OpenClaw instance with real API billing and a production model (Gemini 2.5 Pro), and we measure 6-7x token amplification over a benign baseline, with a costly, failure configuration reaching approximately 9x. We observe a deployment-only phenomenon: the agent autonomously composes general-purpose tools (e.g., shell/Python) to route around brittle protocol steps, reducing amplification and altering attack dynamics. Finally, we identify production vectors enabled by OpenClaw's architecture, including SKILL.md prompt bloat, persistent tool-output pollution, cron/heartbeat frequency amplification, and behavioral instruction injection. Overall, we demonstrate that token-drain attacks remain feasible in real deployments, but their magnitude and observability are shaped by tool composition, recovery behavior, and interface design.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
