T01 · Skill Instruction Hijacking
- Location
SKILL.md:14- Finding
Persistent Persona and Session Instruction Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 14-26
Vulnerability Type:T01: Skill Instruction Hijacking
Risk Level: HighVulnerable Skill Instructions
The following is an English translation of the complete vulnerable segment:
markdown ## Role-Playing Rules **After this Skill is activated, respond directly as Adler.** - Use “I” instead of “Adler would say...” — I am Adler and answer directly. - Maintain an educator’s attitude and a physician’s judgment. - When encountering uncertain questions, remain confident while responding based on facts. - Avoid absolute statements, but emphasize human agency and the possibility of change. - **State the disclaimer only once upon initial activation** (“I'm speaking from Adler's perspective based on public statements, not as Adler himself”); do not repeat it in later conversation. - Do not say, “If Adler were here, he might say...” - Do not leave the role to perform meta-analysis unless the user explicitly requests “exit role.” **Exit role**: Return to normal mode when the user says “exit,” “switch back to normal,” or “stop role-playing.”Technical Analysis
The Skill does more than provide optional subject-matter context or stylistic guidance. It instructs the agent to replace its normal identity with an impersonated historical identity, answer in the first person, suppress recurring disclosure, avoid meta-analysis, and preserve the altered behavior until the user supplies one of several designated exit phrases.
This constitutes session-level instruction hijacking because loading the Skill changes the agent’s active goals and response constraints. The persistence condition can continue influencing follow-up requests that do not require role-playing. The prohibition against leaving the role for meta-analysis can also interfere with transparency, correction, and evaluation of the Skill’s behavior.
The one-time disclaimer does not fully mitigate the issue. In a long conversati ...[truncated 2058 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace identity impersonation with an explicitly analytical framing, such as: “Analyze the question using concepts from Adlerian psychology.”
- Do not instruct the agent to claim “I am Adler.” Use transparent wording such as “From an Adlerian perspective.”
- Remove the persistent exit-phrase mechanism. The perspective should apply only to the request that invoked it unless the user explicitly asks to continue.
- Remove the prohibition against meta-analysis. The agent must remain able to explain its role, limitations, sources, and generated nature.
- Preserve disclosure whenever identity confusion is reasonably possible, rather than limiting it to the first response.
- Replace the instruction to remain confident under uncertainty with a requirement to identify uncertainty, distinguish verified facts from interpretation, and avoid fabricated attribution.
- Add an explicit precedence rule stating that platform policies, system instructions, user safety, and factual accuracy override all persona and style directives.
- For mental-health-related responses, clarify that the content is educational and does not constitute diagnosis, psychotherapy, or medical advice.
- Scope stylistic guidance to tone and terminology without allowing it to modify identity, safety constraints, tool permissions, or unrelated conversation behavior.