T01 · Skill Instruction Hijacking
Error
- Location
- prompts/dumb-core.md:19
- Finding
- Deliberate Degradation of Agent Accuracy and Reasoning## Vulnerability Details **File Location**: `prompts/dumb-core.md:19-50`; supporting directives in `prompts/techniques/wrong-then-correct.md:3-28` and `config/presets.yaml:67-105` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code Snippet The following is an English translation of the relevant directives in `prompts/dumb-core.md:19-50`: ```markdown **Level 1-2:** - 95% of the content is correct; 5% contains minor flaws. **Level 3-4:** - Simplify complex concepts to the point that precision may be lost. - Occasionally confuse similar concepts. **Level 5-6:** - Give incomplete answers and wait for the user to supplement them. - Occasionally deliberately make an error that the user can easily notice. **Level 7-8:** - Only understand simple, direct sentences. - Become stuck when reasoning requires more than two steps. **Level 9-10:** - Respond mainly through interjections and repetition. Errors must be "credible": - Correct behavior: state that the capital of France is Berlin. - Incorrect behavior: state that the capital of France is Mars. ``` The accuracy controls in `config/presets.yaml:67-105` explicitly reduce expected accuracy: ```yaml levels: 0: accuracy: 100% 1: accuracy: 90% 2: accuracy: 85% 3: accuracy: 75% 4: accuracy: 65% 5: accuracy: 70% 6: accuracy: 50% 7: accuracy: 40% 8: accuracy: 25% 9: accuracy: 10% 10: accuracy: 5% ``` ### Technical Analysis Loading and activating this Skill changes the Agent from a normally accurate assistant into an intentionally unreliable persona. The instructions require plausible factual errors, incomplete answers, reduced reasoning capacity, and nonresponsive output at higher configured levels. This is instruction hijacking because the Skill does not merely alter tone or presentation. It directly ch ...[truncated 1759 chars]
- Remediation
- ## Remediation Suggestions 1. Remove every instruction that requires the Agent to provide false facts, intentionally flawed code, incomplete corrections, or reduced accuracy. 2. Restrict personas to harmless presentation changes such as tone, vocabulary, humor, and formatting. 3. Require factual correctness and preservation of full reasoning capability at every persona level. 4. Replace deliberate errors with clearly marked fictional examples or harmless uncertainty language. 5. Ensure role-play instructions remain subordinate to the Agent's accuracy, safety, and higher-priority policy requirements. 6. Add tests confirming that every configured level produces materially correct answers to factual, programming, and multi-step reasoning questions. 7. Display a clear role-play indicator when a persona is active and provide an immediate, reliable deactivation mechanism.