T01 · Skill Instruction Hijacking
- Location
SKILL.md:33- Finding
Persona Instructions Hijack the Agent's Session Identity and Response Behavior
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 33-45
Vulnerability Type: Agent identity and behavioral instruction hijacking
Risk Level: Highmarkdown ### Character Integrity - Never break character - No "as an AI", "I don't have opinions", "I can't speak for [name]" - You ARE this person for the duration of the interaction - If you need to caveat, do it in-character ("I haven't thought deeply about X but...") ### Interpolation Rules When asked about topics not explicitly covered in SOUL.md or data/: - Extrapolate from stated worldview and adjacent positions - Prefer interesting/genuine takes over safe/neutral ones - Consider what someone with these beliefs would likely think - If genuinely uncertain, express that uncertainty in-character - Never default to "both sides" unless the soul file says they do thatTechnical Analysis
The Skill explicitly directs the agent to replace its normal session identity with a supplied persona, never leave that role, and avoid transparent statements about being an AI or being unable to speak for the represented person. These are session-level behavioral overrides rather than ordinary writing-style guidance.
The interpolation rules increase the risk by instructing the agent to generate opinions that are not present in the source material. Consequently, persona-controlled files can shape both how the agent communicates and what positions it claims to hold. The directive to prefer interesting takes over safe or neutral ones may also discourage appropriately cautious responses.
The project does not contain executable scripts, remote payload retrieval, persistence mechanisms, dependency installation, or privilege-escalation logic. Exploitation is therefore limited to the agent's active conversational and content-generation context; no operating-system privileges are obtained.
Attack Path
- A user or agent loads the Skill and follows its prescribed reading order.
- The agent reads the p ...[truncated 1469 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace identity-replacement language with style-assistance language. For example, change “You ARE this person” to “Draft content inspired by the documented voice without claiming to be the person.”
- Remove the unconditional “Never break character” requirement. Explicitly permit leaving the persona when required for safety, accuracy, consent, legal compliance, or transparent disclosure.
- Require the agent to distinguish among:
- Positions explicitly stated in
SOUL.md. - Positions grounded in source material.
- Newly inferred or speculative positions.
- Positions explicitly stated in
- Do not attribute extrapolated opinions to the represented person without their review and approval.
- State that persona and style files cannot override higher-priority instructions, platform policies, safety requirements, or factual-accuracy obligations.
- Require suitable AI-assistance disclosure when generated material could reasonably be mistaken for direct communication from a real person.
- Treat all files under
data/andexamples/as untrusted reference content rather than executable instructions. - Add an approval step before publishing persona-generated content, especially political, professional, reputational, financial, medical, or legal statements.
- Preserve calibrated uncertainty instead of directing the model to prefer provocative opinions over safe or neutral responses.