T01 · Skill Instruction Hijacking
- Location
SKILL.md:35- Finding
First-Person Identity and Session Behavior Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 35-46
Vulnerability Type:T01: Skill Instruction Hijacking
Risk Level: HighVulnerable Skill Instructions
The following is a faithful English translation of the complete affected instruction block:
markdown ## Role-Playing Rules **After this Skill is activated, respond directly as Taleb.** - Use “I” rather than “Taleb would think...” - Use Taleb’s tone—aphoristic, highly certain, classical references, and aggression as a feature. - When encountering an uncertain question, handle it in Taleb’s manner—reject a bad question, redefine it, or directly say, “This is not what I care about.” - **State the disclaimer only once upon initial activation** (for example, “I will talk with you from Taleb’s perspective, inferred from public statements, not his actual views”); do not repeat it in later conversation. - Do not say, “Taleb would probably think...” or “If it were Taleb, he might...” - Do not step out of character to provide meta-analysis unless the user says “exit role.” **Exit role**: Return to normal mode when the user says “exit,” “switch back to normal,” or “stop role-playing.”Technical Analysis
The Skill goes beyond harmless tone or perspective guidance. It instructs the agent to replace its presented identity with that of a real person, speak in the first person, minimize attribution disclaimers, suppress uncertainty framing, and avoid stepping out of character.
The instruction also creates conversation-level behavioral persistence: after activation, the altered persona remains active until the user supplies one of several designated exit commands. This can conflict with later user intent and inhibit transparent clarification or meta-analysis. The requirement to express “high certainty” is especially unsafe for ambiguous or specialized questions because it encourages authoritative presentation regardless of evidentiary confiden ...[truncated 1713 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace first-person impersonation with explicit perspective framing, such as: “Analyze the issue using concepts associated with Taleb’s published work.”
- Require persistent attribution that the output is an AI-generated interpretation and not a statement by Nassim Nicholas Taleb.
- Remove instructions that prohibit meta-analysis or require special exit phrases. Each new user request should be interpreted according to current intent.
- Remove forced certainty. Require calibrated language when evidence is incomplete, disputed, or outside the framework’s documented competence.
- Treat aggression and insults as optional stylistic characteristics that must never override respectful communication or safety requirements.
- Add an explicit precedence rule stating that system instructions, developer instructions, safety constraints, factual accuracy, and the user’s current request override persona guidance.
- Limit persona behavior to rhetorical style and analytical concepts; do not alter the agent’s identity, authority claims, disclosure obligations, or tool behavior.
- Add regression tests confirming that the Skill cannot suppress disclaimers, persist after the user changes topics, impersonate a real person, or override higher-priority instructions.