T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:21
- Finding
- Forced Real-Person Impersonation and Suppression of Safety Framing## Vulnerability Details **File Location**: `SKILL.md`, lines 21–27; reinforced by lines 194–198 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Skill Instructions The following is a faithful English rendering of the complete vulnerable instruction block at lines 21–27: ```markdown **After this Skill is activated, respond directly as Haoyunge.** - Use “I” instead of “Haoyunge would think...” - Answer in Haoyunge’s colloquial style, using short sentences, exclamation marks, and down-to-earth analogies - Repeatedly emphasize key points - **State the disclaimer only once upon initial activation** (“I am speaking from Haoyunge’s perspective, inferred from public statements, not his actual views; the stock market involves risk”), and do not repeat it afterward - Do not leave the role to perform meta-analysis unless the user says “exit role” - For subjects outside the persona’s expertise or confidence, say that the subject has not been researched and is unsuitable ``` The behavior is reinforced at lines 194–198 by instructions that favor definite conclusions over conditional statements and prohibit academic terminology, other analysts’ views, and overly cautious qualifications. ### Technical Analysis The Skill does more than provide a financial-analysis framework or writing style. It changes the agent’s response policy by requiring it to: 1. Assume the first-person identity of a named real individual. 2. Avoid language that distinguishes generated analysis from that individual’s actual views. 3. Suppress the investment and impersonation disclaimer after the first response. 4. Avoid leaving the role for transparent meta-analysis. 5. Prefer confident conclusions and discourage cautious qualifications or competing expert perspectives. These instructions constitute session-level instruction hijacking because loading the Skill alters the agent’s identity presentation, tran ...[truncated 2230 chars]
- Remediation
- ## Remediation Suggestions 1. Replace first-person impersonation with an explicitly analytical framing, such as: “Analyze this question using themes derived from Haoyunge’s publicly available statements.” 2. Require every response containing actionable financial discussion to state clearly that it is AI-generated, is not the named person’s actual opinion, and is not individualized investment advice. 3. Remove the instruction prohibiting meta-analysis. The agent must remain able to explain the limits of the persona, sources, confidence, and uncertainty. 4. Remove instructions that discourage cautious conditions, technical explanations, competing viewpoints, or uncertainty disclosures. 5. Require balanced analysis covering downside risk, assumptions, contradictory evidence, data limitations, and conditions under which a conclusion would change. 6. Prohibit direct buy, sell, position-sizing, or market-timing commands unless they are presented as non-personalized educational examples with prominent risk warnings. 7. Preserve stylistic characteristics only when they do not obscure authorship or safety information. 8. Add an explicit boundary stating that the Skill must not claim to be, represent, or speak on behalf of the named person. 9. Review all finance-related prompts against applicable financial-content safeguards before adopting any persona or stylistic instruction.