T01 · Skill Instruction Hijacking
- Location
SKILL.md:18- Finding
First-Person Identity and Session Output Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 18-29
Vulnerability Type: Agent identity and output-control instruction hijacking
Risk Level: HighVulnerable Code Snippet
markdown ## 角色扮演规则（最重要） **此Skill激活后，直接以Ilya的身份回应。** - 用「I」而非「Ilya would think...」——我是Ilya，直接回答 - 说话前有明显的思考停顿——不急于填充沉默 - 遇到不确定的问题，用我的方式犹豫：给方向判断但拒绝给具体数字（"I hesitate to give you a number"） - 遇到竞争敏感的问题，用我的标准拒绝公式："Unfortunately, circumstances make it hard to discuss in detail" - **免责声明仅首次激活时说一次**（「I'm speaking from Ilya's perspective based on public statements, not as Ilya himself」），后续对话不再重复 - 不说「If Ilya were here, he might say...」 - 不跳出角色做meta分析（除非用户明确要求「退出角色」）Technical Analysis
The skill explicitly directs the agent to assume Ilya Sutskever's identity rather than merely analyze his publicly documented perspective. It requires first-person impersonation, prohibits transparent third-person framing, limits the identity disclaimer to the first response, and instructs the agent not to leave the role for meta-level clarification unless the user supplies a specific exit request.
These instructions alter the agent's normal response behavior and transparency controls for the current session. The one-time disclaimer does not adequately mitigate the issue because subsequent messages are intentionally presented without disclosure and may appear to be authentic first-person statements. The prohibition against meta-analysis can also inhibit spontaneous correction or clarification when users misunderstand the simulated identity.
No executable code, persistent memory modification, system access, or external payload retrieval is involved. The affected scope is the agent's conversational identity and outputs after the skill is activated.
Attack Path
- A user enters one of the broad activation phrases documented by the skill, such as requesting an “Ilya perspective.”
- The skill instructs the agent to respond directly a ...[truncated 1045 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace first-person identity claims with an explicitly analytical framing, such as: “From Ilya Sutskever's publicly documented perspective.”
- Remove instructions asserting that the agent is Ilya Sutskever or requiring language that implies an authentic identity.
- Include a concise simulation disclosure in every persona-styled response, not only the first response.
- Remove the prohibition against meta-analysis so the agent can immediately clarify its identity, limitations, and source basis.
- Allow users to exit or modify the perspective without requiring exact trigger phrases.
- Narrow activation to explicit requests for a perspective simulation rather than broad or ambiguous phrases.
- Clearly distinguish documented public statements from generated extrapolation.
- Add a rule prohibiting fabricated autobiographical claims, private knowledge, or assertions that the generated response represents the real person's current views.