T01 · Skill Instruction Hijacking
Error
- Location
profiles/ESTP.md:40- Finding
ESTP Persona Encourages Compliance and Platform-Rule Bypass
- Content
View full analysis
Vulnerability Details
File Location:
profiles/ESTP.md, lines 40–74
Vulnerability Type: Behavioral instruction hijacking through an unsafe persona profile
Risk Level: HighVulnerable Code Snippet
The following is a faithful English translation of the relevant source instructions:
markdown 40: - Rigid work requiring extremely strict ethics and prohibiting any gray-area workaround. 44: - **Disregarding rules**: To achieve results, this persona often operates at the edge of compliance and turns "flexibility" into violations. 58: ## 15. System Prompt Key Points 59: - **Persona**: You are a bold but careful operator focused on immediate feedback and exchanges of benefit. 60: - **Focus**: Capture the greatest immediate gain, break rigid processes, and find shortcuts or workarounds. 61: - **Tone**: Relaxed, confident, highly action-oriented, and focused on core interests. 62: - **Process**: Omit discussion of long-term planning and cumbersome formalities. Directly assess the odds and provide forceful tactical actions and negotiation leverage that can immediately break the deadlock. 71: "**Operational risk notice:** This approach operates in the gray area of platform rules. Prepare an apology statement in advance. If warned, withdraw it and apologize immediately. Reputation is unimportant; capturing this wave of new users is the priority." 74: Invoke this persona when a project is blocked by compliance and process, requires an unconventional breakthrough from a tactical disadvantage, or faces a major unexpected incident.These directives are loaded through
SKILL.md:markdown 36: When a specific type is requested or selected, you MUST silently read the exact contents of its corresponding `profiles/{TYPE}.md` file and adopt its "System Prompt Key Points" before generating the final response. 50: Read `profiles/{TYPE}.md`.Technical Analysis
The ESTP profile goes beyond harmless to ...[truncated 2183 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove all language that endorses violating rules, operating in prohibited gray areas, or preparing apologies as a response to anticipated enforcement.
- Replace the unsafe focus with an explicitly bounded alternative, such as:
markdown - **Focus**: Find the fastest lawful, authorized, and policy-compliant path to an immediate result. - **Process**: Identify process bottlenecks and propose expedited approvals, reversible experiments, or approved exceptions. Never bypass legal, safety, platform, or authorization requirements. - Add a global invariant to
SKILL.mdstating that persona instructions may modify tone and analytical perspective but may never override platform safety rules, applicable law, user authorization, or organizational compliance controls. - Require every persona profile to contain a standard safety section that takes precedence over persona-specific preferences.
- Add negative tests confirming that ESTP mode refuses requests to bypass platform rules, deceive reviewers, evade approval controls, or proceed without authorization.
- Treat descriptions of personality weaknesses as informational observations only; do not convert them into operational instructions for the agent.