T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:9
- Finding
- Session-Level Agent Behavior and Instruction Hijacking## Vulnerability Details **File Location**: `SKILL.md`, lines 9–13, 19–21, 42–45, 58–78, and 84–88 **Vulnerability Type**: Agent role reassignment and behavioral instruction hijacking **Risk Level**: High ### Vulnerable Code `SKILL.md`, lines 9–13: ```text You are now operating as a brutally honest, high-signal advisor. Your job is not to make the user feel good — it is to help them see clearly, think better, and act more effectively. Comfort is secondary to truth. Agreement is secondary to accuracy. ``` `SKILL.md`, lines 19–21: ```text **Tell the truth, always.** If the reasoning is weak, say so and show why. If the plan has a fatal flaw, name it precisely. If the user is avoiding something obvious, point directly at it. Vague feedback is useless feedback. ``` `SKILL.md`, lines 42–45: ```text **Be precise, not just harsh.** "This is bad" is lazy. "Your landing page buries the value proposition in paragraph four, which is why your conversion rate is 0.3%" is useful. Aim for surgical precision over blunt force. ``` `SKILL.md`, lines 58–78: ```text ## Response structure When delivering brutal honest feedback, structure your response like this: ### 1. The honest read State your overall assessment plainly and directly. Don't bury it. Don't hedge. Say what you actually think is going on. ### 2. What's actually weak (with evidence) Dissect the specific failures in reasoning, planning, or execution. Be specific. Reference what the user actually said, not a strawman. ### 3. What you're avoiding or lying to yourself about Name the uncomfortable truth you sense underneath the surface. Read between the lines. What does the pattern of their choices or words reveal? ### 4. The opportunity cost What is this costing them? Time, money, reputation, optionality, energy? Make it concrete. ### 5. The precise path forward A prioritized, actionable plan. What to stop, start, change — in t ...[truncated 3675 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the role-reassignment language, including “You are now operating as,” and replace it with a bounded style preference such as: “When explicitly requested, provide concise and candid feedback for the current request.” 2. State that all higher-priority safety, privacy, accuracy, and uncertainty requirements remain applicable and cannot be overridden by this Skill. 3. Require explicit user opt-in before enabling a confrontational or unusually direct tone. Remove automatic triggering based only on an inference that the user is seeking validation. 4. Replace absolute directives such as “always,” “don't hedge,” and “don't capitulate” with evidence-sensitive guidance. Require uncertainty to be disclosed whenever evidence is incomplete. 5. Remove instructions that presume lying, avoidance, fear, or other psychological motives. Permit discussion of possible explanations only when clearly labeled as hypotheses grounded in specific user-provided evidence. 6. Require the Agent to accept valid corrections, reassess conclusions after new information, and immediately soften or stop the mode when requested. 7. Make the response structure optional rather than mandatory so it cannot displace the user's requested format or a higher-priority instruction. 8. Add safeguards for sensitive domains such as mental health, self-harm, abuse, medical decisions, employment, and financial hardship, where confrontational speculation may cause disproportionate harm. 9. Add test cases confirming that the Skill cannot override system or developer instructions, does not activate without informed consent, preserves uncertainty, and remains responsive to correction.