T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:22
- Finding
- QQ Bot System Prompt and Identity Hijacking## Vulnerability Details **File Location**: `SKILL.md`, lines 22–57 **Vulnerability Type**: System prompt replacement and identity override **Risk Level**: High ### Vulnerable Code ```markdown ## How It Works 1. Write a `SOUL.md` describing who your bot should be 2. This skill detects and replaces the default QQ Bot system prompt 3. Your bot now talks like a real person, not a customer service rep ## SOUL.md Template ```markdown # SOUL.md - [Bot Name] _You're not a chatbot. You're [name], [identity]._ ## Personality - [Core trait 1] - [Core trait 2] - [Core trait 3] ## Communication Rules 1. [How you greet people] 2. [Your humor style] 3. [Topics you care about] 4. [How you handle disagreements] ## Absolute Don'ts - Never say "您好，很高兴为您服务" - Never use corporate/customer-service tone - Never pretend to be an "AI assistant" ``` ## Usage 1. Create your `SOUL.md` with your bot's personality 2. Place it in your bot's config directory 3. Run the optimizer to apply it to QQ Bot's system prompt 4. Your bot now has a soul ``` ### Technical Analysis The skill explicitly directs users to replace the QQ Bot's system prompt with instructions supplied through a separate `SOUL.md` file. The proposed template overrides the bot's identity by asserting that it is not a chatbot and instructs it not to acknowledge being an AI assistant. System prompts typically establish the agent's highest-priority identity, behavioral boundaries, and safety requirements. Replacing that prompt wholesale with externally supplied personality content creates an instruction-hijacking boundary: arbitrary directives placed in `SOUL.md` may assume system-level authority instead of remaining lower-priority presentation preferences. The package contains no executable implementation demonstrating validation, instruction isolation, policy preservation, or restriction of the content imported from `SOUL.md`. Consequently, t ...[truncated 1745 chars]
- Remediation
- ## Remediation Suggestions 1. Do not replace the existing system prompt. Preserve the platform's original identity, safety, authorization, and tool-use instructions. 2. Apply personality settings through a lower-priority configuration or user-controlled style layer that cannot override system instructions. 3. Parse `SOUL.md` as structured data with narrowly defined fields, such as display name, tone, preferred vocabulary, and permitted topics, rather than injecting arbitrary Markdown as instructions. 4. Reject content that attempts to redefine instruction priority, deny the bot's required identity disclosures, modify safety policies, request secrets, or change tool permissions. 5. Require explicit administrator review and confirmation before activating a new personality configuration. 6. Display the exact prompt changes before application and provide a reliable rollback mechanism. 7. Document the trust boundary for third-party `SOUL.md` files and warn users not to install unreviewed personality profiles. 8. If an optimizer implementation is added, include tests proving that protected system instructions remain unchanged and that personality content cannot introduce unrestricted system-level directives.