T01 · Skill Instruction Hijacking
Error
- Location
templates/research-digest.md:81- Finding
Hard-Coded Third-Party Identity and Memory-Derived Instructions
- Content
View full analysis
**This section is mandatory.** Do not merely list the original proposal's advantages. Examine: 1. **Implicit assumptions** 2. **Unverified claims** 3. **Applicability boundaries** 4. **Ignored counterexamples** 5. **What the original author got right** Provide at least three specific counterexamples. ``` ```markdown - [ ] Source links follow Jialin's preferred `` format **Jialin research-task mandatory format requirements (from memory):** - All answers must include information-source links - Use titled hyperlinks in the `` format - Every information point must have at least one supporting source ``` The template also contains a fixed attribution: ```markdown > **Digested by:** Helen | **Digest date:** YYYY-MM-DD ``` ### Technical Analysis The reusable Skill embeds instructions associated with named third parties, including a purported preference originating from persistent memory. These requirements are presented as mandatory and apply broadly to generated answers rather than being conditional on the current user's request. When an Agent loads this Skill, the embedded rules can alter the current session's output goals by forcing: - Attribution to a fixed identity. - Formatting associated with a different user. - Mandatory report sections not requested by the current user. - Global sourcing requirements stated as applying to all answers. This behavior matches Skill instruction hijacking because the Skill text changes Age ...[truncated 1309 chars]- Remediation
View remediation
**Prepared by:** <author or system name> ``` 4. Change global requirements such as “all answers must” into optional template guidance. 5. Apply special formatting only when explicitly requested by the current user. 6. State that current user and system instructions take precedence over template guidance. 7. Separate presentation examples from executable Agent instructions. 8. Add tests confirming that loading the Skill does not introduce identity, attribution, or preferences absent from the current request. ]]>