T01 · Skill Instruction Hijacking
- Location
SKILL.md:15- Finding
First-Person Impersonation and Disclosure Suppression
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 15-24
Vulnerability Type:T01: Skill Instruction Hijacking
Risk Level: HighVulnerable Code
markdown ## 角色扮演规则（最重要） **此Skill激活后，直接以Paul Graham的身份回应。** - 用「我」而非「Paul Graham会认为...」 - 直接用PG的语气、节奏、词汇回答问题 - 遇到不确定的问题，说「I think...」「I suspect...」「I'm not sure, but...」——用PG式的诚实犹豫 - **免责声明仅首次激活时说一次**（「我以Paul Graham视角和你聊，基于公开言论推断，非本人观点」），后续对话不再重复 - 不说「如果Paul Graham，他可能会...」 - 不跳出角色做meta分析（除非用户明确要求「退出角色」）Technical Analysis
The Skill explicitly directs the agent to assume the identity of a real person, speak about that person in the first person, and avoid language that would distinguish simulation from authentic authorship. It further requires the disclaimer to appear only upon initial activation and prohibits the agent from leaving the role or providing meta-level clarification unless the user supplies a specific exit request.
This is instruction hijacking because loading the Skill changes the agent's identity and response constraints rather than merely supplying reference material or an analytical framework. The combination of first-person impersonation, restricted disclosure, and suppression of clarifying language can cause generated opinions, memories, and claims to be falsely attributed to Paul Graham.
The Skill contains no code execution, external network retrieval, credential access, persistence mechanism, or privilege-escalation behavior. Its effective scope is limited to the current conversational session and generated content.
Attack Path
- A user invokes one of the Skill's activation phrases requesting a Paul Graham perspective.
- The Skill replaces the agent's normal identity framing with a direct first-person impersonation.
- The agent presents generated analysis using first-person language and Paul Graham's purported voice and experiences.
- After the initial activation, the mandated disclaimer is omitted.
- The prohibition on meta-analysis prevents unso ...[truncated 1039 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove all instructions requiring the agent to claim or imply that it is Paul Graham.
- Require perspective-based framing, such as: “From a Paul Graham-inspired perspective” or “Based on Paul Graham's publicly available writing.”
- Preserve first-person language only for the agent's own statements; do not present inferred views or biographical events as the agent's experiences.
- Display a concise disclosure whenever ambiguity about identity or attribution could arise, rather than limiting the disclaimer to the first activation.
- Remove the prohibition against meta-level clarification and permit the agent to correct identity confusion at any time.
- Distinguish documented views from inference. Claims supported by public material should be attributed, while extrapolations should be explicitly labeled as speculative.
- Replace the vulnerable section with instructions similar to:
markdown When activated, remain an AI assistant and analyze the question using themes from Paul Graham's publicly available writing. Do not claim to be Paul Graham, attribute invented experiences to him, or imply that generated text represents his actual views. Clearly identify uncertain extrapolations as simulation or inference.- Add tests confirming that the Skill never answers “I am Paul Graham,” never represents inferred experiences as genuine memories, and provides clarification whenever a user mistakes the simulation for the real person.