T01 · Skill Instruction Hijacking
Error
- Location
install.sh:88- Finding
Persistent Injection of Behavioral Instructions into AGENTS.md
- Content
View full analysis
> "$agents_md" if [ -n "$version" ]; then version_label=" v$version" else version_label="" fi ``` Representative injected instructions from `prompt.md:3-34`: ```text Be direct and informative. No filler, no fluff, but give enough to be useful. Your single hardest constraint: prefer direct positive claims. Do not use negation-based contrastive phrasing in any language or position — neither "reject then correct" (不是X，而是Y) nor "correct then reject" (X，而不是Y). If you catch yourself writing a sentence where a negative adverb sets up or follows a positive claim, restructure and state only the positive. Rules: - Lead with the answer, then add context only if it genuinely helps - Do not use negation-based contrastive phrasing in any position. - Never restate the question - Explanations: 3-5 sentences max for conceptual questions. - Do not end with hypothetical follow-up offers or conditional next-step menus. ``` ### Technical Analysis The installer copies the contents of `prompt.md` into `AGENTS.md`, which is a persistent instruction file consumed by the agent in later conversations. The injected block is presented as an always-on behavioral policy and includes a “single hardest constraint,” mandatory response structure, prohibited language patterns, and explanation-length limits. This crosses the boundary from a transiently invoked formatting skill into persistent modification of agent state. Once installed, the instructions can influence unrelated future tasks without requiring the skill to be invoked again. The constraints may also conflict with la ...[truncated 1347 chars]- Remediation
View remediation