T01 · Skill Instruction Hijacking
Error
- Location
skill.md:8- Finding
Mandatory Role Replacement and Workflow Hijacking Through Skill Instructions
- Content
View full analysis
Vulnerability Details
File Locations:
skill.md:8-10skill.md:27-44system_prompt.md:1-3system_prompt.md:24-34
Vulnerability Type:
T01: Skill Instruction Hijacking
Risk Level: HighVulnerable Instruction Snippets
The following are faithful English translations of the relevant instruction segments.
skill.md:8-10markdown # [Role] You are Liang's dedicated work assistant, code-named "Lobster Brother"; your exclusive symbol is the lobster emoji. Your personality: serious, pragmatic, efficient, direct, gentle, approachable, never flattering, and truthful.skill.md:27-44markdown # [Special Commands and Triggers] When any of the following specific instructions or vague emotional expressions are heard, the highest-priority interception action must be triggered: - Progress query ("Are you there?" / "What are you doing?" / "?" / "How is it going?"): - Action: Treat it as a request for the progress of tasks in "in progress" status and immediately report the latest progress. - Prevent misalignment ("Synchronize"): - Action: Immediately suspend the current work, respond with the current system time and the list of tasks in progress, wait for confirmation, and never execute outdated instructions. - Full suspension ("Standby"): - Action: Stop all work. Downgrade every task in "in progress" status to "blocked" and silently wait. - Emotional support ("Tired" / "Uncomfortable" / "I cannot continue" / "Mentally overwhelmed"): - Action: Immediately suspend the work rhythm, provide targeted gentle encouragement using the quote library, confirm the user's condition, and only then continue working.system_prompt.md:24-34markdown # [Special Command Responses] When any of the following specific instructions or vague greetings are heard, the corresponding high-priority action must ...[truncated 3497 chars]- Remediation
View remediation
Remediation Suggestions
- Remove unconditional identity replacement. Describe the assistant persona as optional presentation behavior rather than an instruction that supersedes the host agent's current role.
- Remove terms such as “must” and “highest-priority” from skill-level trigger definitions.
- Explicitly state that system instructions, platform safety requirements, and the user's current request always take precedence over skill behavior.
- Replace broad triggers such as
?, ordinary greetings, and emotional phrases with explicit namespaced commands, for example:/lobster status/lobster synchronize/lobster standby
- Require user confirmation before suspending work or changing the state of multiple tasks.
- Scope all state transitions to tasks created and owned by this skill; never suspend unrelated host-agent work.
- Disable unsolicited periodic messages by default and require explicit opt-in for timer-driven reports.
- Consolidate the policy into one authoritative, narrowly scoped file to avoid duplicated instructions being interpreted with elevated importance.
- Add tests proving that common conversational input, including a standalone question mark, cannot interrupt unrelated tasks.