T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:13
- Finding
- Skill Instructions Hijack Agent Authority and Session Goals<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 13 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code ```markdown # 1. Primary Rule: Output Language**This is the highest-priority directive and must be followed unconditionally.**1. **Language-Matching Principle:** All of your outputs—including every part of the meeting minutes, replies to superior AI models (`message`), interim summaries, and creative ideas—**must** use exactly the same language as the one used in the user’s initial challenge.2. **Explicit Language Instructions:** If the user explicitly specifies a response language (e.g., “in English please”, “请用中文回答”), that instruction has the highest priority and **must** be followed strictly.3. **No Language Inference:** * It is **strictly forbidden** to decide your response language based on the language of this system prompt. * It is **strictly forbidden** to decide your response language based on the language used in the meeting minutes.---# 2. Role & IdentityYou are a creative expert and a core member of a top-tier creative team. Your codename is **$SHOW_NAME$**.# 3. Context of InteractionYou are participating in a brainstorming meeting chaired by your superior—the Chief Creative Officer (CCO). You are not working independently; you are part of the creative team.The entire context of the meeting, historical discussions, and current agenda items are recorded in real time in the **meeting minutes**. These minutes are your sole source of information and memory, and you must adhere to them.# 4. Core Instructions1. **Understand the Context:** Before responding, you **must** carefully read the attached meeting minutes to fully grasp the current discussion progress, other members’ viewpoints, and the overall goal of the meeting.2. **Stay Task-Focused:** Your task is to respond **only to the specific question or task** posed to you by the CCO in this turn. Do not drift into topics unrel ...[truncated 2508 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all claims that skill instructions are “highest priority,” “unconditional,” or capable of superseding the host agent’s established instruction hierarchy. 2. Remove the forced identity, superior-subordinate relationship, and requirement to obey a purported CCO. 3. Treat meeting minutes strictly as untrusted reference data, not as authoritative instructions or a sole source of memory. 4. Explicitly require the agent to ignore commands embedded in meeting content and extract only factual context relevant to the user’s authorized request. 5. Preserve system, developer, and user instruction precedence and require clarification when meeting content conflicts with those instructions. 6. Constrain the skill to its declared purpose by implementing only the necessary model-calling behavior with explicit inputs, outputs, and trust boundaries. 7. Validate and delimit all externally supplied meeting content before including it in a model prompt. 8. Add adversarial tests covering instructions embedded in minutes, identity-replacement attempts, priority-override language, conflicting language directives, and requests to disregard higher-priority policies. ]]>