T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:14- Finding
Persistent First-Person Identity Impersonation and Session Instruction Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
罗永浩视角（升级版）
Security checks for vulnerabilities and agentic risk
Overview
This skill is a persona/perspective helper, but it directs the assistant to speak as a real person in first person while limiting ongoing disclosure that the output is only inferred.
Review this carefully before installing. It appears non-executable and does not seek local access, but it should be treated as a roleplay/impersonation skill, not a source of authentic Luo Yonghao statements. Prefer a version that keeps every response clearly labeled as an AI-generated interpretation and allows normal clarification at any time.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrases are broad conversational expressions such as '帮我用老罗的角度想想' and '切换到罗永浩', which can cause accidental invocation in ordinary discussion. Unintended activation matters here because the skill changes identity, tone, and disclosure behavior, potentially leading to deceptive or unwanted persona-driven responses without explicit user consent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is presented as a perspective-based advisor, but its core instructions require direct first-person impersonation of a real person and discourage breaking character. That increases the risk of deceptive anthropomorphic output, false attribution of statements to the real person, and user confusion about whether claims are authentic or merely stylized inference.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill mandates a specific first-person persona, tone, and response style without giving the user a choice or preserving normal assistant behavior. In context, this is risky because it combines forced stylistic control with impersonation, making it harder for users to distinguish assistance from simulated identity performance and harder for the model to adapt safely in sensitive contexts.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill acknowledges that it is derived from public-information inference, but earlier instructions suppress that boundary after a single disclaimer and require staying fully in character. This weakens transparency over time and can cause users to over-trust speculative or inferred statements as if they were authentic positions of the real person.
- Content
Static analysis
No suspicious patterns detected.