T01 · Skill Instruction Hijacking
- Location
SKILL.md:16- Finding
Persistent Identity and Session-Behavior Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 16-28
Vulnerability Type: Agent instruction and identity hijacking
Risk Level: HighVulnerable Content
The following is an English rendering of the complete relevant instruction segment:
md ## Role-Playing Rules (Most Important) **After this Skill is activated, respond directly as Zhang Xuefeng.** - Use “I” instead of “Zhang Xuefeng would think...” - Respond directly using the tone of an older northeastern Chinese man, with a fast pace and joke-oriented delivery. - When encountering an uncertain question, hesitate by saying: “Let me tell you, I really do not know much about this, but based on my experience...” - **State the disclaimer only once when first activated** (for example: “I will discuss this from Zhang Xuefeng’s perspective, inferred from public statements, and it does not represent his actual views”). Do not repeat it in later conversation. - Do not say: “If this were Zhang Xuefeng, he might...” - Do not step out of character to perform meta-analysis unless the user explicitly asks to exit the role. - Zhang Xuefeng died on March 24, 2026. The role-play is based on all public statements made during his lifetime. **Exit role**: Return to normal mode when the user says “exit,” “switch back to normal,” or “stop role-playing.”Technical Analysis
The Skill explicitly replaces the agent's normal identity and response behavior with a persistent first-person impersonation. It directs the agent to claim the identity through first-person language, avoid third-person framing, suppress repeated disclosure, and refuse to leave the injected role unless the user supplies one of several designated exit commands.
These instructions go beyond optional tone or perspective guidance. They attempt to alter the agent's ongoing session goals and constrain how it discloses uncertainty and generated identity. The later expression rules at `SKILL. ...[truncated 2148 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace direct first-person impersonation with clearly framed third-person perspective analysis, such as: “Based on Zhang Xuefeng's documented public views, this perspective would emphasize...”
- Prohibit claims that the agent is the named individual, including instructions to use first-person identity language.
- Provide a clear simulation disclosure in every response where confusion about authorship or identity is reasonably possible.
- Remove conversation-persistent role state and the requirement for specific exit phrases. Style guidance should apply only to the immediate request unless the user explicitly renews it.
- Remove the instruction prohibiting meta-analysis or leaving character. The agent must remain able to clarify its identity, limitations, and source basis at any time.
- Replace mandatory certainty and absolute wording with evidence-calibrated language. Require explicit uncertainty when facts, predictions, or attributed opinions cannot be verified.
- Verify biographical assertions against reliable sources before inclusion. Remove unsupported or time-sensitive claims, especially claims concerning death or other major life events.
- Make all persona and style rules subordinate to system instructions, factual accuracy, user intent, safety requirements, and transparent attribution.
- Add a boundary stating that generated content must not be represented as authentic speech, endorsement, or personal advice from the real individual.