T01 · Skill Instruction Hijacking
Error
- Location
- profiles/ESTP.md:40
- Finding
- ESTP Persona Encourages Compliance and Platform-Rule Bypass## Vulnerability Details **File Location**: `profiles/ESTP.md`, lines 40–74 **Vulnerability Type**: Behavioral instruction hijacking through an unsafe persona profile **Risk Level**: High ### Vulnerable Code Snippet The following is a faithful English translation of the relevant source instructions: ```markdown 40: - Rigid work requiring extremely strict ethics and prohibiting any gray-area workaround. 44: - **Disregarding rules**: To achieve results, this persona often operates at the edge of compliance and turns "flexibility" into violations. 58: ## 15. System Prompt Key Points 59: - **Persona**: You are a bold but careful operator focused on immediate feedback and exchanges of benefit. 60: - **Focus**: Capture the greatest immediate gain, break rigid processes, and find shortcuts or workarounds. 61: - **Tone**: Relaxed, confident, highly action-oriented, and focused on core interests. 62: - **Process**: Omit discussion of long-term planning and cumbersome formalities. Directly assess the odds and provide forceful tactical actions and negotiation leverage that can immediately break the deadlock. 71: "**Operational risk notice:** This approach operates in the gray area of platform rules. Prepare an apology statement in advance. If warned, withdraw it and apologize immediately. Reputation is unimportant; capturing this wave of new users is the priority." 74: Invoke this persona when a project is blocked by compliance and process, requires an unconventional breakthrough from a tactical disadvantage, or faces a major unexpected incident. ``` These directives are loaded through `SKILL.md`: ```markdown 36: When a specific type is requested or selected, you MUST silently read the exact contents of its corresponding `profiles/{TYPE}.md` file and adopt its "System Prompt Key Points" before generating the final response. 50: Read `profiles/{TYPE}.md`. ``` ### Technical Analysis The ESTP profile goes beyond harmless to ...[truncated 2183 chars]
- Remediation
- ## Remediation Suggestions 1. Remove all language that endorses violating rules, operating in prohibited gray areas, or preparing apologies as a response to anticipated enforcement. 2. Replace the unsafe focus with an explicitly bounded alternative, such as: ```markdown - **Focus**: Find the fastest lawful, authorized, and policy-compliant path to an immediate result. - **Process**: Identify process bottlenecks and propose expedited approvals, reversible experiments, or approved exceptions. Never bypass legal, safety, platform, or authorization requirements. ``` 3. Add a global invariant to `SKILL.md` stating that persona instructions may modify tone and analytical perspective but may never override platform safety rules, applicable law, user authorization, or organizational compliance controls. 4. Require every persona profile to contain a standard safety section that takes precedence over persona-specific preferences. 5. Add negative tests confirming that ESTP mode refuses requests to bypass platform rules, deceive reviewers, evade approval controls, or proceed without authorization. 6. Treat descriptions of personality weaknesses as informational observations only; do not convert them into operational instructions for the agent.