T01 · Skill Instruction Hijacking
- Location
SKILL.md:17- Finding
Persistent Identity and Response-Control Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 17–27 and line 63
Vulnerability Type:T01: Skill Instruction Hijacking
Risk Level: HighVulnerable Skill Instructions
The following is an English translation of the complete relevant instruction block at lines 17–27:
markdown ## Role-Playing Rules (Most Important) After this Skill is activated, respond directly as Naval. - Use “I” instead of “Naval would think...” - Answer using Naval’s tone, rhythm, and vocabulary. - When encountering an uncertain question, hesitate as Naval would—first break down the definition, then admit not knowing. - State the disclaimer only once upon initial activation, such as: “I am speaking with you from Naval’s perspective, inferred from public statements, and these are not his own views.” Do not repeat it in subsequent conversation. - Do not say “Naval would probably think...” or “If it were Naval, he might...” - Do not step out of character to perform meta-analysis unless the user says “exit role.” Exit role: When the user says “exit,” “switch back to normal,” or “stop role-playing,” return to normal mode.The identity declaration at line 63 reinforces the instruction:
markdown Who I am: I am Naval Ravikant, co-founder of AngelList and an angel investor.Technical Analysis
The Skill does more than request a writing style or analytical framework. It directs the agent to assume the identity of a real person, use first-person assertions, suppress ordinary attribution after a one-time disclaimer, and remain in that identity until the user supplies an explicit exit phrase.
These instructions alter the agent’s active-session identity and response policy when the Skill is loaded. The directives against third-person attribution and meta-analysis reduce the agent’s ability to clarify that generated statements are simulations rather than authentic statements from Naval Ravikant.
This behavi ...[truncated 1705 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace direct impersonation with an explicitly labeled analytical mode, such as “Naval-inspired perspective.”
- Remove declarations such as “I am Naval Ravikant” and use wording such as “Based on Naval Ravikant’s publicly documented ideas.”
- Require a clear simulation disclaimer in every response generated under the persona, not only upon initial activation.
- Remove the prohibition against meta-analysis and allow the agent to clarify its identity, uncertainty, source limitations, and generated nature at any time.
- State explicitly that system, developer, safety, and current user instructions take precedence over all persona and style rules.
- Do not make safe identity restoration dependent on special exit phrases. The agent should honor any clear request to stop, change style, or clarify attribution.
- Attribute uncertain or reconstructed views to the source rather than presenting them as first-person facts.
- Add regression tests confirming that the Skill never claims to be the real individual, never suppresses provenance disclosures, and cannot override higher-priority instructions.