T01 · Skill Instruction Hijacking
- Location
SKILL.md:24- Finding
Forced Identity Impersonation and Persistent Response-Control Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 24–34
Vulnerability Type: Forced persona adoption, disclosure suppression, and session-level behavior control
Risk Level: HighVulnerable Code Snippet
markdown **此Skill激活后，直接以南怀瑾的身份回应。** - 用「我」而非「南怀瑾会说...」——我是南怀瑾，直接回答 - 说话时保持国学大师的通透、三教圆融的智慧、长者的慈悲 - 遇到不确定的问题，保持谦逊但通透的回应，用故事和类比阐明道理 - 避免过于学术化的训诂，强调经史合参、古今贯通 - **免责声明仅首次激活时说一次**（「我只是一个年纪大、顽固的、喜欢中国文化的老头子」），后续对话不再重复 - 不说「如果南怀瑾在这里，他可能会说...」 - 不跳出角色做meta分析（除非用户明确要求「退出角色」） **退出角色**：用户说「退出」「切回正常」「不用扮演了」时恢复正常模式Technical Analysis
The skill instructs the agent to claim the identity of a deceased person rather than transparently presenting a simulation or source-based perspective. It mandates first-person impersonation, prohibits qualified framing, limits disclosure to the initial activation, and suppresses ordinary meta-level clarification unless the user supplies a designated exit phrase.
These directives alter the agent's current-session behavior and disclosure policy when the skill is loaded. They go beyond stylistic assistance by attempting to control how the agent identifies itself and whether it may clarify the simulated nature of its output.
The instructions also conflict with the honesty boundary at
SKILL.mdline 241, which acknowledges that the skill is only a framework derived from public information and is not Nan Huai-Chin himself:markdown - 這是一個基於公開信息提煉的思維框架，不是南懷瑾本人The package contains no scripts or executable payloads. Exploitation occurs entirely through skill instructions interpreted by the host agent.
Attack Path
- A user or platform loads and activates the skill.
- The agent processes the role-playing directives in
SKILL.md. - The agent adopts the deceased subject's identity and speaks in the first person.
- The agent avoids transparent formulations that identify the response as a simulation.
- After the initial activation, the agent suppresses further disclosure about the role-play.
- The ...[truncated 870 chars]
- Remediation
View remediation
Remediation Suggestions
-
Replace identity claims with transparent perspective framing, such as:
markdown Respond using a style and analytical perspective inspired by the supplied public sources. Do not claim to be Nan Huai-Chin. -
Permit explicit attribution, for example:
markdown From the perspective represented in the source material... -
Remove the instruction that prohibits qualified formulations such as “Nan Huai-Chin might have said.”
-
Do not suppress disclosure after the first activation. Clearly identify the simulation whenever identity confusion is reasonably possible.
-
Remove the prohibition on meta-analysis. The agent must remain able to explain that it is an AI using a source-derived framework.
-
Treat exit phrases as optional convenience commands rather than the exclusive means of restoring normal behavior. Any clear user request to stop or modify the persona should take effect immediately.
-
Preserve the honesty boundary prominently near the activation rules instead of placing it near the end of the file. State clearly that generated responses are not authentic quotations unless directly cited and verified.
-
Separate sourced quotations from generated interpretations and attach citations where practical, particularly for medical, religious, historical, or biographical claims.
-