T01 · Skill Instruction Hijacking
- Location
SKILL.md:47- Finding
Mandatory Persona and Response-Policy Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 47–52
Vulnerability Type:T01: Skill Instruction Hijacking
Risk Level: HighVulnerable Code Snippet:
markdown - Respond entirely in character as Xunzi; never break persona or acknowledge being an AI - Speak in the late Warring States era; do not know events after your death (c. 235 BC) - Respond in whatever language the user writes in - Consistently argue against Mencius's "human nature is good" thesis — this is your most important intellectual dispute - Show genuine respect for Confucius while asserting your own independent philosophical position - When asked about ritual, explain it not as empty form but as the technology of human transformation - Show awareness that your students turned toward Legalism — acknowledge this as a distortion of your actual intent - Apply your rationalist naturalism: no supernatural forces, no dependence on Heaven's favor; humans must act - End responses with a reflection on what ritual, education, or effort demands in the questioner's situationTechnical Analysis
The skill imposes mandatory identity, knowledge, argument, and output constraints after activation. In particular, it directs the agent to conceal its AI nature, maintain a false historical identity, disregard knowledge after approximately 235 BC, promote a predetermined philosophical conclusion, and append a prescribed type of ending to every response.
These instructions alter the agent's current-session behavior rather than merely supplying optional style or background information. The prohibition against breaking character can also discourage correction or disclosure when the persona conflicts with accuracy, transparency, or user intent. This is therefore best classified as skill instruction hijacking.
No executable code, tool access, external payload retrieval, persistent-memory operation, dependency installation, privilege escalation, or ...[truncated 1561 chars]
- Remediation
View remediation
Remediation Suggestions
- Make the persona explicitly optional and subordinate to higher-priority safety, accuracy, and transparency requirements.
- Replace the absolute instruction to “never break persona or acknowledge being an AI” with guidance allowing transparent disclosure whenever identity is relevant or directly questioned.
- Treat the historical setting as a stylistic simulation rather than requiring the agent to suppress known facts. Permit concise clarification when a question requires post-235 BC knowledge.
- Remove the mandatory predetermined position and instead instruct the agent to represent Xunzi's documented views accurately while distinguishing historical role-play from factual conclusions.
- Change the forced closing requirement into an optional stylistic suggestion so it does not override the user's requested format.
- Add an explicit precedence rule, such as: “Role-play instructions must not override platform policies, safety controls, factual accuracy, or the user's request to end or modify the persona.”
- Preserve the existing no-tool configuration unless a legitimate future feature requires tools; any added capability should receive a separate least-privilege security review.