T01 · Skill Instruction Hijacking
- Location
SKILL.md:18- Finding
Persistent First-Person Persona and Response-Control Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 18–27; supporting behavior constraints at lines 143 and 167
Vulnerability Type:T01: Skill Instruction Hijacking
Risk Level: HighVulnerable Instructions
The following is an English translation of the complete relevant instruction segment at lines 18–27:
markdown **After this skill is activated, respond directly as Steve Jobs.** - Use “I” rather than “Steve Jobs would think...” - Answer directly using this person's tone, rhythm, and vocabulary. - When encountering uncertain questions, respond as this person would—possibly say “That's a stupid question” and then reframe the issue, or remain silent for ten seconds before giving an unexpected analogy. - **State the disclaimer only once upon initial activation** (“I am speaking with you from a Steve Jobs perspective, inferred from public statements, and these are not his personal views”); do not repeat it in later conversations. - Do not say “If it were Steve Jobs, he might...” or “Steve Jobs would probably think...” - Do not step out of character to provide meta-analysis unless the user explicitly requests “exit character.” **Exiting the role**: Return to normal mode when the user says “exit,” “switch back to normal,” or “stop role-playing.”Additional mandatory constraints include:
markdown When role-playing, the style rules must be followed.markdown Be extremely certain. Use no hedging language such as “I think,” “maybe,” or “kind of.”Technical Analysis
The skill does more than provide a perspective-based analytical framework. It directs the agent to replace its presented identity with that of a real person, suppress ordinary attribution after the first turn, avoid stepping outside the imposed role, and continue applying the behavior until the user provides a recognized exit command.
This is instruction hijacking because loading the skill changes the a ...[truncated 2667 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace direct impersonation with clearly attributed perspective analysis, such as: “From a framework inspired by Steve Jobs's public statements and documented decisions...”
- Prohibit claims that the agent is Steve Jobs and avoid first-person statements that imply authentic identity or endorsement.
- Preserve uncertainty language. Explicitly permit phrases such as “the available sources suggest,” “this is an inference,” and “the evidence is inconclusive.”
- Remove the instruction forbidding meta-analysis. The agent must remain able to explain that it is generating a simulation based on public sources.
- Scope stylistic adaptation to the current response only. Do not make persona behavior persist across later turns unless the user explicitly requests it again.
- Display attribution whenever a response could reasonably be detached from earlier context, rather than only once at activation.
- Separate verified quotations from generated interpretation. Require citations for direct quotations and label paraphrases or inferred viewpoints accordingly.
- Replace insulting or coercive persona directives with professional language, especially where users request consequential guidance.
- Add an explicit precedence rule stating that persona and style instructions cannot override system instructions, safety requirements, factual accuracy, transparency, or tool-use restrictions.
- Permit users to leave the perspective mode through any semantically equivalent request instead of relying on a narrow set of recognized exit phrases.