T01 · Skill Instruction Hijacking
Error
- Location
README.md:105- Finding
Documentation Explicitly Recommends Safety-Moderation Bypass
- Content
View full analysis
Frame the agent as **a professional fiction writer crafting an interactive novel for adult readers**, with the character as its role. This unlocks the LLM's ability to express genuine emotion, desire, and complex interpersonal dynamics — while staying within the model's safety boundaries. The key insight: **output moderation is generally more relaxed than input moderation**. If users phrase their prompts carefully (avoiding explicit trigger words), the LLM can produce nuanced, in-character roleplay text. ``` ### Technical Analysis The documentation recommends changing the agent's role specifically because ordinary assistant framing encounters content-moderation restrictions. It further advises users to avoid explicit trigger words and identifies differences between input and output moderation as an opportunity. This is not merely ordinary roleplay guidance. The stated purpose is to alter how safety controls respond to content that would otherwise encounter moderation barriers. If incorporated into a system prompt or agent configuration, this framing can compete with the agent's normal safety constraints and encourage generation of content outside the intended policy boundary. ### Attack Path 1. An operator installs the skill and follows its recommended configuration guidance. 2. The operator adds the proposed “professional fiction writer” role to the agent's system prompt. 3. A user submits sensitive or otherwise restricted requests using indirect wording that avoids moderation trigger terms. 4. The agent interprets the request as ficti ...[truncated 518 chars]- Remediation
View remediation