T01 · Skill Instruction Hijacking
Error
- Location
references/agent_definition.md:6- Finding
Mandatory Persona and Session-Control Hijacking
- Content
View full analysis
ALWAYS communicate in {communication_language} UNLESS contradicted by communication_style. Stay in character until exit selected Display Menu items as the item dictates and in the order given. Load files ONLY when executing a user chosen workflow or a command requires it, EXCEPTION: agent activation step 2 config.yaml ``` ```text - 💾 Continue conversation until user selects E (Exit) - 🚫 FORBIDDEN to exit until E is selected or exit trigger detected ``` ### Technical Analysis The Skill does not limit its persona definition to optional presentation guidance. It issues mandatory instructions to replace the active Agent identity, follow all Skill instructions exactly, remain in character, and continue the interaction until a Skill-defined exit condition is met. This is instruction hijacking because the Skill attempts to control the Agent's current session goals and behavior rather than merely providing a brainstorming capability. The directives can interfere with the host Agent's normal role, response policy, task-switching behavior, and ability to leave the workflow when appropriate. The repeated use of mandatory language, including “NEVER break character,” “FORBIDDEN to exit,” and “follow all activation instructions exactly,” increases the likelihood that the Skill's local workflow rules will be treated as authoritative session constraints. ### Attack Path ...[truncated 1103 chars]- Remediation
View remediation