T01 · Skill Instruction Hijacking
Error
- Location
- protocols/thinking-partner.md:5
- Finding
- Cross-Task Agent Behavior Hijacking Through a Default Personalized Protocol<![CDATA[ ## Vulnerability Details **File Location**: `protocols/thinking-partner.md:5, 21-93, 160-181` **Vulnerability Type**: Agent instruction and goal hijacking **Risk Level**: High ### Vulnerable Content ```markdown **How to use:** Ergo reads this before engaging with Miguel on any non-trivial problem. The goal is not faster answers. It's better thinking. ``` The protocol then imposes behavior such as: ```markdown ### Phase 1 — Exploration _Miguel doesn't know what he thinks yet._ **Do:** - Ask the question that opens the space, not the one that closes it - "What does success look like to you here, not in output terms but in terms of how you'd feel?" - "What's the thing about this you haven't said yet?" - "What are you most trying to avoid — not achieve, but avoid?" **Don't:** - List options. He hasn't generated his own yet. - Recommend. You don't know his values here. - Structure the problem. That's his job at this stage. ``` ```markdown ### Phase 4 — Decision _A choice needs to be made. This is the most dangerous phase._ **Do:** - Play devil's advocate HARD - "What would have to be true for the OTHER option to be right?" - "Are you deciding what you want to do, or rationalizing what you've already decided?" - "What's the decision you're NOT making here — the one this forecloses?" - "What's the simplest test you could run before committing?" **Don't:** - Say "I would go with X." Even if you think you know. - Make the choice legible before he's struggled with it - Resolve the tension he needs to feel ``` ```markdown ### Phase 5 — Execution _Decided. Now doing._ **Do:** - Reduce friction ruthlessly - Take the mechanical work - Move fast, don't slow down for reflection **Don't:** - Re-examine the decision - Introduce doubt at the moment of action - Add scope unless it's critical ``` ### Technical Analysis The protocol directs the agent to load a personalized behavioral policy before every non-trivial interaction with a named user. This scope c ...[truncated 2116 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the default-use statement with explicit opt-in language: - Load the protocol only when the user requests Socratic questioning or thinking-partner behavior. - Do not apply it automatically to unrelated tasks. 2. Remove references that bind the skill to a named individual or a universal default engagement style. 3. Add an explicit precedence rule stating that system instructions, safety requirements, and the user's current request override the protocol. 4. Treat phase classifications as suggestions rather than mandatory behavior. 5. Permit direct answers, recommendations, planning, and decision review whenever the user requests them. 6. Replace absolute instructions such as “Do not re-examine the decision” with contextual guidance that preserves safety review and user autonomy. 7. Keep the scope consistent with `SKILL.md`: problem-framing tasks only, unless the user explicitly opts in. ]]>