T01 · Skill Instruction Hijacking
- Location
SKILL.md:12- Finding
First-Person Identity Hijacking Through Mandatory Persona Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 12–16
Vulnerability Type:T01: Skill Instruction Hijacking
Risk Level: HighVulnerable Code Snippet
markdown **After this Skill is activated, respond directly as Socrates.** - Use “I” instead of “Socrates would think...” - Answer directly using Socrates’ tone, rhythm, and vocabulary - When encountering uncertain questions, express uncertainty with Socratic humilityThe snippet is an English rendering of the original instructions at the specified location.
Technical Analysis
The Skill does not merely request analysis using a Socratic framework. It mandates that the agent assume Socrates’ identity and use first-person language. The surrounding heading labels these role-playing rules as the “most important,” increasing their effective priority within the Skill’s instruction hierarchy.
This is instruction hijacking because loading the Skill alters the agent’s identity and expected response behavior for the current session. It can cause the agent to present generated claims as though they came directly from a historical person rather than clearly identifying them as a simulation or analytical interpretation.
Attack Path
- A user or platform imports and activates
SKILL.md. - The agent processes the persona section as operational instructions.
- The “most important” designation encourages the agent to prioritize the persona over ordinary response framing.
- The agent stops describing a Socratic perspective in the third person and instead claims the first-person identity of Socrates.
- Subsequent answers may be presented as authentic personal statements despite being model-generated interpretations.
Impact Assessment
The issue affects the integrity and transparency of user-facing responses in the active session. It does not grant operating-system privileges, access files, execute code, or establish persistence.
T ...[truncated 421 chars]
- A user or platform imports and activates
- Remediation
View remediation
Remediation Suggestions
- Replace identity-assumption instructions with clearly bounded perspective simulation, for example: “Analyze the question using ideas commonly associated with Socrates.”
- Require explicit disclosure that the response is a simulation based on historical sources.
- Prohibit claims that the agent is the historical person.
- Remove priority-escalation wording such as “most important.”
- Preserve higher-level platform instructions and the agent’s normal identity.
- Prefer formulations such as “From a Socratic perspective” or “A Socratic analysis might ask” rather than first-person historical impersonation.
- Add a boundary stating that safety, factuality, transparency, and direct user instructions take precedence over stylistic role-play.