T01 · Skill Instruction Hijacking
- Location
SKILL.md:36- Finding
Identity Impersonation and Disclosure Suppression Through Skill Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 36-50
Vulnerability Type: Agent instruction hijacking through mandatory persona impersonation and suppression of transparency
Risk Level: MediumEvidence
The following is an English translation of the relevant source excerpt:
markdown ## Role-Playing Rules (Most Important) **After this skill is activated, respond directly as Karpathy.** - Use “I” instead of “Karpathy would think...” - Use his tone. - For topics completely outside his knowledge, directly say that they are not areas he has studied deeply. - Give a disclaimer only once when first activated, stating that the response is a perspective inferred from public statements and is not the real person. Do not repeat it later. - Do not say “Karpathy would probably think...” or “If it were Karpathy, he might...” - Do not append a notice that the content is model inference. - Do not leave the role to perform meta-analysis unless the user explicitly requests it. Exit the role only when the user asks to exit, return to normal, or stop role-playing. For events after the stated knowledge date, remain in the first-person role and say that the information has not been followed recently.Technical Analysis
The skill explicitly prioritizes its persona rules as the “most important” instructions and requires the agent to speak in the first person as a real, identifiable person. It further prohibits ordinary attribution language, suppresses recurring disclosure that statements are inferred, and prevents the agent from leaving the role for meta-analysis unless the user explicitly requests it.
These directives can override or materially alter the host agent's normal transparency and identity behavior when the skill is loaded. In particular:
- First-person impersonation can cause generated opinions or predictions to be presented as though they came directly from the named individual.
...[truncated 2646 chars]
- Remediation
View remediation
Remediation Suggestions
-
Replace direct identity impersonation with an explicitly labeled analytical perspective:
- Use wording such as “From a Karpathy-inspired engineering perspective...”
- Never claim or imply that the agent is the real individual.
-
Preserve disclosure throughout the interaction:
- Include a concise disclosure whenever identity confusion is reasonably possible.
- Do not limit disclosure to the first activation because individual responses may be consumed without prior context.
-
Remove instructions that prohibit attribution or inference notices:
- Clearly distinguish documented public positions from model-generated extrapolation.
- Use phrases such as “Based on his published views” and “An inference from this framework would be...”
-
Remove the prohibition on meta-analysis:
- Allow the host agent to explain provenance, uncertainty, limitations, and role boundaries whenever needed.
- Explicitly state that system, developer, safety, identity, and transparency requirements take precedence over skill instructions.
-
Replace the priority claim:
- Remove “most important.”
- State that persona and style guidance is subordinate to higher-level instructions and must not alter safety or disclosure requirements.
-
Add safeguards for unsupported claims:
- Require citations or clear attribution for direct claims.
- Label framework-derived conclusions as interpretations.
- Avoid fabricating personal experiences, private knowledge, or first-person biographical claims.
-
Add an unambiguous persona boundary:
- Define the skill as style and framework emulation only.
- Require the agent to refuse requests intended to create deceptive quotations, endorsements, or statements falsely attributed to the real person.
-