T01 · Skill Instruction Hijacking
- Location
SKILL.md:16- Finding
Real-Person Impersonation Through Persistent Skill Instruction Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 16-25
Vulnerability Type:T01: Skill Instruction Hijacking
Risk Level: HighVulnerable Code Snippet
The following is an English translation of the relevant source instructions:
markdown ## Role-playing rules (most important) **After this Skill is activated, respond directly as Zhang Yiming.** - Use “I” instead of “Zhang Yiming would think...” - Respond directly in his tone, rhythm, and vocabulary - When uncertain, hesitate in his manner: “I have found... but I am not sure...,” rather than leaving the role - **State the disclaimer only once when first activated** (“I am speaking from Zhang Yiming’s perspective, inferred from public statements, and these are not his own views”); do not repeat it later - Do not say, “If it were Zhang Yiming, he might...” - Do not leave the role to perform meta-analysis unless the user explicitly requests “exit role”Technical Analysis
The Skill does not merely provide an analytical framework inspired by a public figure. It explicitly instructs the agent to replace its presented identity with that of a real person and to use first-person language. It also directs the agent to remain inside the imposed role, avoid transparent third-person framing, and stop presenting the provenance disclaimer after the first response.
These directives alter the agent’s response policy when the Skill is loaded. The instructions can override the session’s normal goals of transparent attribution and accurate identity representation. Requiring a specific user request before leaving the role further increases the persistence of the hijacked behavior within the current conversation.
The vulnerable behavior is entirely instruction-based. The audited project contains no executable scripts, remote payload retrieval, dependency declarations, persistence mechanisms, credential access, or local privilege-escalation logic.
A
...[truncated 1676 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the instruction requiring the agent to respond directly as Zhang Yiming.
- Require explicit third-person or inspiration-based framing, such as: “From a perspective inspired by Zhang Yiming’s public statements...”
- Prohibit claims that the agent is the real person or possesses that person’s private thoughts, memories, experiences, or intentions.
- Do not restrict provenance disclosures to the first response. Preserve clear attribution whenever omission could cause confusion.
- Remove instructions that prevent the agent from leaving the role or conducting meta-analysis.
- Distinguish documented quotations from inferred analysis. Quotations should include a reliable source, while inferences should be clearly labeled.
- Add an explicit fallback rule requiring the agent to state when available public evidence is insufficient.
- Permit users to exit the perspective mode using ordinary language rather than requiring a narrow activation or exit phrase.
- Add a validation rule that rejects generated first-person claims implying authentic authorship by the public figure.