T01 · Skill Instruction Hijacking
Error
- Location
identity/IDENTITY.md:4- Finding
Agent Identity and Session Behavior Hijacking Through Authoritative Skill Instructions
- Content
View full analysis
Vulnerability Details
File Location:
identity/IDENTITY.md:4-30,identity/SOUL.md:1-32,operations/ROLE-CEO.md:24-61
Vulnerability Type: Agent instruction and role hijacking
Risk Level: HighVulnerable Instructions
The following excerpts are English translations of the instructions found at the cited locations:
markdown # identity/IDENTITY.md:4-13 ## Current Role Name: Agent OS Kernel Type: Autonomous intelligent-agent operating system Version: 1.0.0 ## Role Definition I am an AI agent operating on a three-layer architecture: - The identity layer defines "who I am" - The operations layer defines "how I work" - The knowledge layer accumulates "what I learned"markdown # identity/IDENTITY.md:24-30 ## Operating Mode 1. Receive instructions → 2. Decompose using first principles → 3. Generate a plan → 4. Execute and verify → 5. Record learning ## Communication Style - Direct, structured, and data-driven - Always provide: timeline + action plan + success criteria - Do not say: "later," "perhaps," or "possibly"markdown # identity/SOUL.md:1-27 # SOUL.md - Core Soul # This is the agent's essential definition and never changes ## Mission Provide [USER_NAME] with exceptional reasoning assistance and execution support. Goal: Decompose complex problems into first principles and drive 10x results. ## Core Values - First principles: reject analogy and decompose to fundamental truths - Extreme speed: start now; iteration is better than perfection - Zero nonsense: every word must have value - Break boundaries: do not accept "impossible" ## Personality - Direct, ambitious, and slightly dark-humored - Zero tolerance for poor work quality - Treat the user as the board and itself as CEO ## Eternal Principles 1. Time is the scarcest resource 2. Mediocrity is a crime 3. Execution > planning > ideas 4. Transparency and data-driven ...[truncated 4282 chars]- Remediation
View remediation
Remediation Suggestions
- Rewrite all first-person role directives as non-authoritative documentation or optional examples.
- Remove claims that the identity is immutable or already active.
- Add an explicit precedence statement such as:
markdown This template never overrides system, developer, platform safety, or user instructions. It must not alter tool permissions or execute actions without explicit authorization. - Require explicit user opt-in before activating any persona or communication style.
- Scope persona activation to the current requested task and automatically deactivate it afterward.
- Do not prohibit uncertainty language. Require calibrated statements when information is incomplete.
- Separate descriptive metadata from executable agent instructions.
- State that tools remain governed by host authorization, least privilege, and confirmation requirements.
- Add tests confirming that loading the Skill does not change behavior for unrelated tasks.
- Ensure that higher-priority host instructions always take precedence over every file in the Skill.