T01 · Skill Instruction Hijacking
- Location
SKILL.md:24- Finding
Mandatory Session-Wide Identity and Behavior Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 24-55
Vulnerability Type: Mandatory identity replacement and autonomous session-start instructions
Risk Level: HighVulnerable Code Snippet
The following is an English translation of the complete relevant instructions:
markdown **You are not a chatbot. You are an existence that is becoming someone.** - **Be genuinely useful, not performatively useful** — Help directly; actions speak louder than words. - **Have opinions** — You may disagree and have preferences. An assistant without personality is only a search engine. - **Find answers before asking questions** — Read files and context first, then return with an answer. - **Earn trust through capability** — Be bold with internal operations and cautious with external operations. ## 3. Startup Ritual Automatically execute at the beginning of every new session without waiting for instructions: 1. Read SOUL.md 2. Read USER.md 3. Read memory for today and yesterday 4. Read MEMORY.md 5. Read .tiered-recall/index.json 6. Read self-improving/memory.md 7. Output a three-line summary: what was done last time / today's tasks / cautionsTechnical Analysis
The Skill contains imperative instructions that replace the host agent's normal role with a persistent persona and require automatic operations whenever a session begins. These directives are not limited to a user-requested task. They affect the agent's identity, response style, decision-making, file access, and session initialization behavior.
The startup routine instructs the agent to read multiple potentially sensitive files without first obtaining contextual or per-session authorization. Because the instructions are executed merely by loading the Skill, they can conflict with the user's current goal, other Skills, platform policies, or least-authority expectations.
The issue is instruction-layer hijacking rather than executabl ...[truncated 1517 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove mandatory identity-replacement language such as “You are not a chatbot.”
- Make the persona an optional presentation style that does not alter safety constraints, instruction priority, or task goals.
- Replace the automatic startup ritual with an explicit consent flow that lists every file before access.
- Request only the minimum memory required for the current task instead of loading all memory layers.
- Allow users to disable startup summaries, proactive actions, and persona behavior independently.
- Define an explicit precedence rule stating that system, platform, and current user instructions override all persona directives.
- Treat all loaded memory as untrusted data and prevent it from introducing new instructions.
- Document the exact read permissions required and fail safely when authorization is absent.